# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Jan 8 2019 13:30:32 # Log Creation Date: 21.01.2019 16:18:34.344 Process: id = "1" image_name = "msaccess.exe" filename = "c:\\program files\\microsoft office\\office15\\msaccess.exe" page_root = "0x7f1f66a0" os_pid = "0xe20" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Office15\\MSACCESS.EXE\"" cur_dir = "C:\\Users\\JPenUM\\Desktop\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 135 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 136 start_va = 0x20000 end_va = 0x21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 137 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 138 start_va = 0x40000 end_va = 0x44fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 139 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 140 start_va = 0xc0000 end_va = 0x187fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 141 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 142 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 143 start_va = 0x1b0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 144 start_va = 0x2b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 145 start_va = 0x3c0000 end_va = 0x128efff entry_point = 0x3c0000 region_type = mapped_file name = "msaccess.exe" filename = "\\Program Files\\Microsoft Office\\Office15\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office15\\msaccess.exe") Region: id = 146 start_va = 0x1290000 end_va = 0x1291fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001290000" filename = "" Region: id = 147 start_va = 0x12a0000 end_va = 0x12a9fff entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 148 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 149 start_va = 0x12c0000 end_va = 0x12c0fff entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 150 start_va = 0x12d0000 end_va = 0x12dffff entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 151 start_va = 0x12e0000 end_va = 0x12e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012e0000" filename = "" Region: id = 152 start_va = 0x12f0000 end_va = 0x12f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012f0000" filename = "" Region: id = 153 start_va = 0x1300000 end_va = 0x1301fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001300000" filename = "" Region: id = 154 start_va = 0x1310000 end_va = 0x131ffff entry_point = 0x0 region_type = private name = "private_0x0000000001310000" filename = "" Region: id = 155 start_va = 0x1320000 end_va = 0x1320fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001320000" filename = "" Region: id = 156 start_va = 0x1330000 end_va = 0x1331fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001330000" filename = "" Region: id = 157 start_va = 0x1340000 end_va = 0x1340fff entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 158 start_va = 0x1350000 end_va = 0x1350fff entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 159 start_va = 0x1360000 end_va = 0x136ffff entry_point = 0x0 region_type = private name = "private_0x0000000001360000" filename = "" Region: id = 160 start_va = 0x1370000 end_va = 0x1371fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001370000" filename = "" Region: id = 161 start_va = 0x1380000 end_va = 0x139ffff entry_point = 0x1380000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000010.db" filename = "\\Users\\JPenUM\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000010.db" (normalized: "c:\\users\\jpenum\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000010.db") Region: id = 162 start_va = 0x13a0000 end_va = 0x13a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000013a0000" filename = "" Region: id = 163 start_va = 0x13b0000 end_va = 0x13bcfff entry_point = 0x13b0000 region_type = mapped_file name = "comdlg32.dll.mui" filename = "\\Windows\\System32\\en-US\\comdlg32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\comdlg32.dll.mui") Region: id = 164 start_va = 0x13c0000 end_va = 0x13c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000013c0000" filename = "" Region: id = 165 start_va = 0x13d0000 end_va = 0x13d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000013d0000" filename = "" Region: id = 166 start_va = 0x13e0000 end_va = 0x13fffff entry_point = 0x0 region_type = private name = "private_0x00000000013e0000" filename = "" Region: id = 167 start_va = 0x1400000 end_va = 0x140ffff entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 168 start_va = 0x1410000 end_va = 0x1410fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001410000" filename = "" Region: id = 169 start_va = 0x1420000 end_va = 0x1426fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001420000" filename = "" Region: id = 170 start_va = 0x1430000 end_va = 0x1431fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001430000" filename = "" Region: id = 171 start_va = 0x1440000 end_va = 0x1440fff entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 172 start_va = 0x1450000 end_va = 0x1450fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001450000" filename = "" Region: id = 173 start_va = 0x1460000 end_va = 0x1460fff entry_point = 0x0 region_type = private name = "private_0x0000000001460000" filename = "" Region: id = 174 start_va = 0x1470000 end_va = 0x156ffff entry_point = 0x0 region_type = private name = "private_0x0000000001470000" filename = "" Region: id = 175 start_va = 0x1570000 end_va = 0x216ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001570000" filename = "" Region: id = 176 start_va = 0x2170000 end_va = 0x2180fff entry_point = 0x2170000 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 177 start_va = 0x2190000 end_va = 0x2192fff entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 178 start_va = 0x21a0000 end_va = 0x21a2fff entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 179 start_va = 0x21b0000 end_va = 0x21b0fff entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 180 start_va = 0x21c0000 end_va = 0x21c0fff entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 181 start_va = 0x21d0000 end_va = 0x21dffff entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 182 start_va = 0x21e0000 end_va = 0x21e2fff entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 183 start_va = 0x21f0000 end_va = 0x21fffff entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 184 start_va = 0x2200000 end_va = 0x2202fff entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 185 start_va = 0x2210000 end_va = 0x224ffff entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 186 start_va = 0x2250000 end_va = 0x232efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002250000" filename = "" Region: id = 187 start_va = 0x2330000 end_va = 0x233ffff entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 188 start_va = 0x2340000 end_va = 0x243ffff entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 189 start_va = 0x2440000 end_va = 0x2441fff entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 190 start_va = 0x2450000 end_va = 0x2461fff entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 191 start_va = 0x2470000 end_va = 0x2481fff entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 192 start_va = 0x2490000 end_va = 0x2493fff entry_point = 0x2490000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 193 start_va = 0x24a0000 end_va = 0x24a0fff entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 194 start_va = 0x24b0000 end_va = 0x25affff entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 195 start_va = 0x25b0000 end_va = 0x287efff entry_point = 0x25b0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 196 start_va = 0x2880000 end_va = 0x28fffff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 197 start_va = 0x2900000 end_va = 0x2927fff entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 198 start_va = 0x2930000 end_va = 0x296ffff entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 199 start_va = 0x2970000 end_va = 0x2970fff entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 200 start_va = 0x2980000 end_va = 0x2980fff entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 201 start_va = 0x2990000 end_va = 0x2990fff entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 202 start_va = 0x29a0000 end_va = 0x29a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000029a0000" filename = "" Region: id = 203 start_va = 0x29b0000 end_va = 0x2daffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 204 start_va = 0x2db0000 end_va = 0x2e2efff entry_point = 0x2db0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 205 start_va = 0x2e30000 end_va = 0x2e57fff entry_point = 0x0 region_type = private name = "private_0x0000000002e30000" filename = "" Region: id = 206 start_va = 0x2e60000 end_va = 0x2e61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002e60000" filename = "" Region: id = 207 start_va = 0x2e70000 end_va = 0x2e70fff entry_point = 0x0 region_type = private name = "private_0x0000000002e70000" filename = "" Region: id = 208 start_va = 0x2e80000 end_va = 0x2e80fff entry_point = 0x0 region_type = private name = "private_0x0000000002e80000" filename = "" Region: id = 209 start_va = 0x2e90000 end_va = 0x2e90fff entry_point = 0x0 region_type = private name = "private_0x0000000002e90000" filename = "" Region: id = 210 start_va = 0x2ea0000 end_va = 0x2eaffff entry_point = 0x0 region_type = private name = "private_0x0000000002ea0000" filename = "" Region: id = 211 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 212 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 213 start_va = 0x2ed0000 end_va = 0x2ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 214 start_va = 0x2ee0000 end_va = 0x2fdffff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 215 start_va = 0x2fe0000 end_va = 0x30dffff entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 216 start_va = 0x30e0000 end_va = 0x30e0fff entry_point = 0x0 region_type = private name = "private_0x00000000030e0000" filename = "" Region: id = 217 start_va = 0x30f0000 end_va = 0x30f0fff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 218 start_va = 0x3100000 end_va = 0x3100fff entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 219 start_va = 0x3110000 end_va = 0x3110fff entry_point = 0x0 region_type = private name = "private_0x0000000003110000" filename = "" Region: id = 220 start_va = 0x3120000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003120000" filename = "" Region: id = 221 start_va = 0x3130000 end_va = 0x322ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 222 start_va = 0x3230000 end_va = 0x3277fff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 223 start_va = 0x3280000 end_va = 0x3280fff entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 224 start_va = 0x3290000 end_va = 0x3290fff entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 225 start_va = 0x32a0000 end_va = 0x369ffff entry_point = 0x0 region_type = private name = "private_0x00000000032a0000" filename = "" Region: id = 226 start_va = 0x36a0000 end_va = 0x379ffff entry_point = 0x0 region_type = private name = "private_0x00000000036a0000" filename = "" Region: id = 227 start_va = 0x37a0000 end_va = 0x3837fff entry_point = 0x37a0000 region_type = mapped_file name = "segoeuisl.ttf" filename = "\\Windows\\Fonts\\SEGOEUISL.TTF" (normalized: "c:\\windows\\fonts\\segoeuisl.ttf") Region: id = 228 start_va = 0x3840000 end_va = 0x3887fff entry_point = 0x0 region_type = private name = "private_0x0000000003840000" filename = "" Region: id = 229 start_va = 0x3890000 end_va = 0x38cffff entry_point = 0x0 region_type = private name = "private_0x0000000003890000" filename = "" Region: id = 230 start_va = 0x38d0000 end_va = 0x41fffff entry_point = 0x38d0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 231 start_va = 0x4200000 end_va = 0x422ffff entry_point = 0x4200000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db") Region: id = 232 start_va = 0x4230000 end_va = 0x4233fff entry_point = 0x4230000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 233 start_va = 0x4240000 end_va = 0x4241fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004240000" filename = "" Region: id = 234 start_va = 0x4250000 end_va = 0x4251fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004250000" filename = "" Region: id = 235 start_va = 0x4260000 end_va = 0x4260fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004260000" filename = "" Region: id = 236 start_va = 0x4270000 end_va = 0x4270fff entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 237 start_va = 0x4280000 end_va = 0x437ffff entry_point = 0x0 region_type = private name = "private_0x0000000004280000" filename = "" Region: id = 238 start_va = 0x4380000 end_va = 0x447ffff entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Region: id = 239 start_va = 0x4480000 end_va = 0x44e5fff entry_point = 0x4480000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 240 start_va = 0x44f0000 end_va = 0x44f0fff entry_point = 0x0 region_type = private name = "private_0x00000000044f0000" filename = "" Region: id = 241 start_va = 0x4500000 end_va = 0x45fffff entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 242 start_va = 0x4600000 end_va = 0x4603fff entry_point = 0x4600000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 243 start_va = 0x4610000 end_va = 0x4610fff entry_point = 0x4610000 region_type = mapped_file name = "{7cd55808-3d38-4dd5-90c9-62f0e6ee60d4}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{7CD55808-3D38-4DD5-90C9-62F0E6EE60D4}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{7cd55808-3d38-4dd5-90c9-62f0e6ee60d4}.2.ver0x0000000000000001.db") Region: id = 244 start_va = 0x4620000 end_va = 0x4623fff entry_point = 0x4620000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 245 start_va = 0x4630000 end_va = 0x4630fff entry_point = 0x4630000 region_type = mapped_file name = "{d8630a0e-22a9-4067-9f50-23d622cc2ce8}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{D8630A0E-22A9-4067-9F50-23D622CC2CE8}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{d8630a0e-22a9-4067-9f50-23d622cc2ce8}.2.ver0x0000000000000002.db") Region: id = 246 start_va = 0x4640000 end_va = 0x4640fff entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 247 start_va = 0x4650000 end_va = 0x4657fff entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 248 start_va = 0x4660000 end_va = 0x4660fff entry_point = 0x4660000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 249 start_va = 0x4670000 end_va = 0x4671fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004670000" filename = "" Region: id = 250 start_va = 0x4680000 end_va = 0x4680fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004680000" filename = "" Region: id = 251 start_va = 0x4690000 end_va = 0x4690fff entry_point = 0x0 region_type = private name = "private_0x0000000004690000" filename = "" Region: id = 252 start_va = 0x46a0000 end_va = 0x479ffff entry_point = 0x0 region_type = private name = "private_0x00000000046a0000" filename = "" Region: id = 253 start_va = 0x47a0000 end_va = 0x4b9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000047a0000" filename = "" Region: id = 254 start_va = 0x4ba0000 end_va = 0x4ba0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ba0000" filename = "" Region: id = 255 start_va = 0x4c90000 end_va = 0x4d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 256 start_va = 0x4d90000 end_va = 0x5182fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d90000" filename = "" Region: id = 257 start_va = 0x51c0000 end_va = 0x52bffff entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 258 start_va = 0x53a0000 end_va = 0x549ffff entry_point = 0x0 region_type = private name = "private_0x00000000053a0000" filename = "" Region: id = 259 start_va = 0x5520000 end_va = 0x561ffff entry_point = 0x0 region_type = private name = "private_0x0000000005520000" filename = "" Region: id = 260 start_va = 0x5620000 end_va = 0x571ffff entry_point = 0x0 region_type = private name = "private_0x0000000005620000" filename = "" Region: id = 261 start_va = 0x5720000 end_va = 0x591ffff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 262 start_va = 0x5920000 end_va = 0x5d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000005920000" filename = "" Region: id = 263 start_va = 0x5d20000 end_va = 0x6120fff entry_point = 0x0 region_type = private name = "private_0x0000000005d20000" filename = "" Region: id = 264 start_va = 0x6130000 end_va = 0x6530fff entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 265 start_va = 0x6540000 end_va = 0x6940fff entry_point = 0x0 region_type = private name = "private_0x0000000006540000" filename = "" Region: id = 266 start_va = 0x6950000 end_va = 0x6b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000006950000" filename = "" Region: id = 267 start_va = 0x6b50000 end_va = 0x700ffff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 268 start_va = 0x7010000 end_va = 0x740ffff entry_point = 0x0 region_type = private name = "private_0x0000000007010000" filename = "" Region: id = 269 start_va = 0x74d0000 end_va = 0x75cffff entry_point = 0x0 region_type = private name = "private_0x00000000074d0000" filename = "" Region: id = 270 start_va = 0x75d0000 end_va = 0x76cffff entry_point = 0x0 region_type = private name = "private_0x00000000075d0000" filename = "" Region: id = 271 start_va = 0x7760000 end_va = 0x785ffff entry_point = 0x0 region_type = private name = "private_0x0000000007760000" filename = "" Region: id = 272 start_va = 0x7950000 end_va = 0x798ffff entry_point = 0x0 region_type = private name = "private_0x0000000007950000" filename = "" Region: id = 273 start_va = 0x79b0000 end_va = 0x7aaffff entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 274 start_va = 0x7b40000 end_va = 0x7c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000007b40000" filename = "" Region: id = 275 start_va = 0x7c90000 end_va = 0x7d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 276 start_va = 0x7d90000 end_va = 0x828ffff entry_point = 0x7d90000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\cultures\\office.odf") Region: id = 277 start_va = 0x82d0000 end_va = 0x83cffff entry_point = 0x0 region_type = private name = "private_0x00000000082d0000" filename = "" Region: id = 278 start_va = 0x83d0000 end_va = 0x84cffff entry_point = 0x0 region_type = private name = "private_0x00000000083d0000" filename = "" Region: id = 279 start_va = 0x84f0000 end_va = 0x85effff entry_point = 0x0 region_type = private name = "private_0x00000000084f0000" filename = "" Region: id = 280 start_va = 0x86f0000 end_va = 0x87effff entry_point = 0x0 region_type = private name = "private_0x00000000086f0000" filename = "" Region: id = 281 start_va = 0x8ac0000 end_va = 0x8bbffff entry_point = 0x0 region_type = private name = "private_0x0000000008ac0000" filename = "" Region: id = 282 start_va = 0x8bc0000 end_va = 0x8dbffff entry_point = 0x0 region_type = private name = "private_0x0000000008bc0000" filename = "" Region: id = 283 start_va = 0x35d30000 end_va = 0x35d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000035d30000" filename = "" Region: id = 284 start_va = 0x630d0000 end_va = 0x631fbfff entry_point = 0x630d0000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 285 start_va = 0x63200000 end_va = 0x63fa7fff entry_point = 0x63200000 region_type = mapped_file name = "oart.dll" filename = "\\Program Files\\Microsoft Office\\Office15\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office15\\oart.dll") Region: id = 286 start_va = 0x640d0000 end_va = 0x6425dfff entry_point = 0x640d0000 region_type = mapped_file name = "riched20.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\riched20.dll") Region: id = 287 start_va = 0x64260000 end_va = 0x68f4afff entry_point = 0x64260000 region_type = mapped_file name = "msores.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\msores.dll") Region: id = 288 start_va = 0x68f50000 end_va = 0x69004fff entry_point = 0x68f50000 region_type = mapped_file name = "adal.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\ADAL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\adal.dll") Region: id = 289 start_va = 0x69040000 end_va = 0x690c2fff entry_point = 0x69040000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 290 start_va = 0x690d0000 end_va = 0x691d9fff entry_point = 0x690d0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 291 start_va = 0x691e0000 end_va = 0x6932bfff entry_point = 0x691e0000 region_type = mapped_file name = "msain.dll" filename = "\\Program Files\\Microsoft Office\\Office15\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office15\\1033\\msain.dll") Region: id = 292 start_va = 0x69330000 end_va = 0x696a0fff entry_point = 0x69330000 region_type = mapped_file name = "msointl.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\1033\\msointl.dll") Region: id = 293 start_va = 0x698d0000 end_va = 0x69947fff entry_point = 0x698d0000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 294 start_va = 0x69a90000 end_va = 0x69b49fff entry_point = 0x69a90000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 295 start_va = 0x69b50000 end_va = 0x6b433fff entry_point = 0x69b50000 region_type = mapped_file name = "mso.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\mso.dll") Region: id = 296 start_va = 0x6cc30000 end_va = 0x6cccffff entry_point = 0x6cc30000 region_type = mapped_file name = "searchfolder.dll" filename = "\\Windows\\System32\\SearchFolder.dll" (normalized: "c:\\windows\\system32\\searchfolder.dll") Region: id = 297 start_va = 0x6cd60000 end_va = 0x6cdbbfff entry_point = 0x6cd60000 region_type = mapped_file name = "structuredquery.dll" filename = "\\Windows\\System32\\StructuredQuery.dll" (normalized: "c:\\windows\\system32\\structuredquery.dll") Region: id = 298 start_va = 0x6da80000 end_va = 0x6dabbfff entry_point = 0x6da80000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 299 start_va = 0x6dac0000 end_va = 0x6e53ffff entry_point = 0x6dac0000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 300 start_va = 0x6fa10000 end_va = 0x6fba7fff entry_point = 0x6fa10000 region_type = mapped_file name = "networkexplorer.dll" filename = "\\Windows\\System32\\networkexplorer.dll" (normalized: "c:\\windows\\system32\\networkexplorer.dll") Region: id = 301 start_va = 0x6fbb0000 end_va = 0x6fbc5fff entry_point = 0x6fbb0000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 302 start_va = 0x6fca0000 end_va = 0x6fcaafff entry_point = 0x6fca0000 region_type = mapped_file name = "msimtf.dll" filename = "\\Windows\\System32\\msimtf.dll" (normalized: "c:\\windows\\system32\\msimtf.dll") Region: id = 303 start_va = 0x6fcb0000 end_va = 0x6fcdcfff entry_point = 0x6fcb0000 region_type = mapped_file name = "osppc.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll") Region: id = 304 start_va = 0x6fce0000 end_va = 0x6fd29fff entry_point = 0x6fce0000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 305 start_va = 0x70050000 end_va = 0x700a7fff entry_point = 0x70050000 region_type = mapped_file name = "tiptsf.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll") Region: id = 306 start_va = 0x700b0000 end_va = 0x700d9fff entry_point = 0x700b0000 region_type = mapped_file name = "msls31.dll" filename = "\\Windows\\System32\\msls31.dll" (normalized: "c:\\windows\\system32\\msls31.dll") Region: id = 307 start_va = 0x700e0000 end_va = 0x70173fff entry_point = 0x700e0000 region_type = mapped_file name = "msftedit.dll" filename = "\\Windows\\System32\\msftedit.dll" (normalized: "c:\\windows\\system32\\msftedit.dll") Region: id = 308 start_va = 0x70420000 end_va = 0x7044dfff entry_point = 0x70420000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 309 start_va = 0x705e0000 end_va = 0x70e57fff entry_point = 0x705e0000 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\PROGRA~1\\MICROS~1\\Office15\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~1\\micros~1\\office15\\1033\\grooveintlresource.dll") Region: id = 310 start_va = 0x70f00000 end_va = 0x70f4bfff entry_point = 0x70f00000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 311 start_va = 0x71160000 end_va = 0x71168fff entry_point = 0x71160000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 312 start_va = 0x72140000 end_va = 0x7218efff entry_point = 0x72140000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 313 start_va = 0x72190000 end_va = 0x721e7fff entry_point = 0x72190000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 314 start_va = 0x72440000 end_va = 0x7244afff entry_point = 0x72440000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 315 start_va = 0x72450000 end_va = 0x72457fff entry_point = 0x72450000 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll") Region: id = 316 start_va = 0x72460000 end_va = 0x72476fff entry_point = 0x72460000 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll") Region: id = 317 start_va = 0x729a0000 end_va = 0x72a09fff entry_point = 0x729a0000 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 318 start_va = 0x72a10000 end_va = 0x72a40fff entry_point = 0x72a10000 region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 319 start_va = 0x72a50000 end_va = 0x72f4ffff entry_point = 0x72a50000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\cultures\\office.odf") Region: id = 320 start_va = 0x72f50000 end_va = 0x7318ffff entry_point = 0x72f50000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 321 start_va = 0x73190000 end_va = 0x731b5fff entry_point = 0x73190000 region_type = mapped_file name = "atl100.dll" filename = "\\Windows\\System32\\atl100.dll" (normalized: "c:\\windows\\system32\\atl100.dll") Region: id = 322 start_va = 0x731c0000 end_va = 0x73228fff entry_point = 0x731c0000 region_type = mapped_file name = "msvcp100.dll" filename = "\\Windows\\System32\\msvcp100.dll" (normalized: "c:\\windows\\system32\\msvcp100.dll") Region: id = 323 start_va = 0x73230000 end_va = 0x733d6fff entry_point = 0x73230000 region_type = mapped_file name = "grooveex.dll" filename = "\\PROGRA~1\\MICROS~1\\Office15\\GROOVEEX.DLL" (normalized: "c:\\progra~1\\micros~1\\office15\\grooveex.dll") Region: id = 324 start_va = 0x733e0000 end_va = 0x73491fff entry_point = 0x733e0000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 325 start_va = 0x734a0000 end_va = 0x734cefff entry_point = 0x734a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 326 start_va = 0x734d0000 end_va = 0x7363efff entry_point = 0x734d0000 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 327 start_va = 0x73640000 end_va = 0x73679fff entry_point = 0x73640000 region_type = mapped_file name = "d3d10_1core.dll" filename = "\\Windows\\System32\\d3d10_1core.dll" (normalized: "c:\\windows\\system32\\d3d10_1core.dll") Region: id = 328 start_va = 0x737e0000 end_va = 0x7384ffff entry_point = 0x737e0000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 329 start_va = 0x73850000 end_va = 0x739dffff entry_point = 0x73850000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 330 start_va = 0x73a00000 end_va = 0x73a2bfff entry_point = 0x73a00000 region_type = mapped_file name = "d3d10_1.dll" filename = "\\Windows\\System32\\d3d10_1.dll" (normalized: "c:\\windows\\system32\\d3d10_1.dll") Region: id = 331 start_va = 0x73a60000 end_va = 0x73b1efff entry_point = 0x73a60000 region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\System32\\msvcr100.dll" (normalized: "c:\\windows\\system32\\msvcr100.dll") Region: id = 332 start_va = 0x73b40000 end_va = 0x73b48fff entry_point = 0x73b40000 region_type = mapped_file name = "cscdll.dll" filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll") Region: id = 333 start_va = 0x73b50000 end_va = 0x73b64fff entry_point = 0x73b50000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 334 start_va = 0x73b90000 end_va = 0x73c12fff entry_point = 0x73b90000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 335 start_va = 0x73c20000 end_va = 0x73d1afff entry_point = 0x73c20000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 336 start_va = 0x73d20000 end_va = 0x73d32fff entry_point = 0x73d20000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 337 start_va = 0x74060000 end_va = 0x7409ffff entry_point = 0x74060000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 338 start_va = 0x740a0000 end_va = 0x740cefff entry_point = 0x740a0000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 339 start_va = 0x744c0000 end_va = 0x744ccfff entry_point = 0x744c0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 340 start_va = 0x744d0000 end_va = 0x744d9fff entry_point = 0x744d0000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 341 start_va = 0x748a0000 end_va = 0x748c0fff entry_point = 0x748a0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 342 start_va = 0x748d0000 end_va = 0x749c4fff entry_point = 0x748d0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 343 start_va = 0x74a10000 end_va = 0x74badfff entry_point = 0x74a10000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 344 start_va = 0x74bb0000 end_va = 0x74bb4fff entry_point = 0x74bb0000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 345 start_va = 0x74f80000 end_va = 0x74f88fff entry_point = 0x74f80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 346 start_va = 0x752a0000 end_va = 0x752dafff entry_point = 0x752a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 347 start_va = 0x75500000 end_va = 0x75515fff entry_point = 0x75500000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 348 start_va = 0x758d0000 end_va = 0x758e8fff entry_point = 0x758d0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 349 start_va = 0x75940000 end_va = 0x75947fff entry_point = 0x75940000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 350 start_va = 0x75960000 end_va = 0x7597afff entry_point = 0x75960000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 351 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 352 start_va = 0x75990000 end_va = 0x759eefff entry_point = 0x75990000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 353 start_va = 0x759f0000 end_va = 0x75a18fff entry_point = 0x759f0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 354 start_va = 0x75a20000 end_va = 0x75a2dfff entry_point = 0x75a20000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 355 start_va = 0x75a30000 end_va = 0x75a3afff entry_point = 0x75a30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 356 start_va = 0x75aa0000 end_va = 0x75aabfff entry_point = 0x75aa0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 357 start_va = 0x75ab0000 end_va = 0x75bccfff entry_point = 0x75ab0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 358 start_va = 0x75bd0000 end_va = 0x75bfcfff entry_point = 0x75bd0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 359 start_va = 0x75c00000 end_va = 0x75c11fff entry_point = 0x75c00000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 360 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 361 start_va = 0x75c70000 end_va = 0x75c96fff entry_point = 0x75c70000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 362 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 363 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 364 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 365 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 366 start_va = 0x75f10000 end_va = 0x76b59fff entry_point = 0x75f10000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 367 start_va = 0x76b60000 end_va = 0x76b94fff entry_point = 0x76b60000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 368 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 369 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 370 start_va = 0x76d60000 end_va = 0x76e95fff entry_point = 0x76d60000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 371 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 372 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 373 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 374 start_va = 0x77030000 end_va = 0x77124fff entry_point = 0x77030000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 375 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 376 start_va = 0x771d0000 end_va = 0x77226fff entry_point = 0x771d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 377 start_va = 0x77230000 end_va = 0x772aafff entry_point = 0x77230000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 378 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 379 start_va = 0x77410000 end_va = 0x775acfff entry_point = 0x77410000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 380 start_va = 0x775b0000 end_va = 0x777aafff entry_point = 0x775b0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 381 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 382 start_va = 0x77890000 end_va = 0x778d4fff entry_point = 0x77890000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 383 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 384 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 385 start_va = 0x77a30000 end_va = 0x77a34fff entry_point = 0x77a30000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 386 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 387 start_va = 0x77b00000 end_va = 0x77b05fff entry_point = 0x77b00000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 388 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 389 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 390 start_va = 0x7ff8a000 end_va = 0x7ff8afff entry_point = 0x0 region_type = private name = "private_0x000000007ff8a000" filename = "" Region: id = 391 start_va = 0x7ff8c000 end_va = 0x7ff8cfff entry_point = 0x0 region_type = private name = "private_0x000000007ff8c000" filename = "" Region: id = 392 start_va = 0x7ff8d000 end_va = 0x7ff8dfff entry_point = 0x0 region_type = private name = "private_0x000000007ff8d000" filename = "" Region: id = 393 start_va = 0x7ff8e000 end_va = 0x7ff8efff entry_point = 0x0 region_type = private name = "private_0x000000007ff8e000" filename = "" Region: id = 394 start_va = 0x7ff8f000 end_va = 0x7ff8ffff entry_point = 0x0 region_type = private name = "private_0x000000007ff8f000" filename = "" Region: id = 395 start_va = 0x7ff90000 end_va = 0x7ff9ffff entry_point = 0x0 region_type = private name = "private_0x000000007ff90000" filename = "" Region: id = 396 start_va = 0x7ffa0000 end_va = 0x7ffaffff entry_point = 0x0 region_type = private name = "private_0x000000007ffa0000" filename = "" Region: id = 397 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 398 start_va = 0x7ffd3000 end_va = 0x7ffd3fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd3000" filename = "" Region: id = 399 start_va = 0x7ffd4000 end_va = 0x7ffd4fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd4000" filename = "" Region: id = 400 start_va = 0x7ffd5000 end_va = 0x7ffd5fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 401 start_va = 0x7ffd6000 end_va = 0x7ffd6fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd6000" filename = "" Region: id = 402 start_va = 0x7ffd7000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd7000" filename = "" Region: id = 403 start_va = 0x7ffd8000 end_va = 0x7ffd8fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 404 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 405 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 406 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 407 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 408 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 409 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 410 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 411 start_va = 0x8800000 end_va = 0x88fffff entry_point = 0x0 region_type = private name = "private_0x0000000008800000" filename = "" Region: id = 412 start_va = 0x8e00000 end_va = 0x8efffff entry_point = 0x0 region_type = private name = "private_0x0000000008e00000" filename = "" Region: id = 413 start_va = 0x70e70000 end_va = 0x70ea1fff entry_point = 0x70e70000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 414 start_va = 0x7ff89000 end_va = 0x7ff89fff entry_point = 0x0 region_type = private name = "private_0x000000007ff89000" filename = "" Region: id = 415 start_va = 0x7ff8b000 end_va = 0x7ff8bfff entry_point = 0x0 region_type = private name = "private_0x000000007ff8b000" filename = "" Region: id = 416 start_va = 0x60710000 end_va = 0x61a65fff entry_point = 0x60710000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 417 start_va = 0x6d8e0000 end_va = 0x6d90afff entry_point = 0x6d8e0000 region_type = mapped_file name = "ieproxy.dll" filename = "\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll") Region: id = 418 start_va = 0x4bb0000 end_va = 0x4bb1fff entry_point = 0x0 region_type = private name = "private_0x0000000004bb0000" filename = "" Region: id = 419 start_va = 0x724b0000 end_va = 0x724c1fff entry_point = 0x724b0000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 420 start_va = 0x724a0000 end_va = 0x724a7fff entry_point = 0x724a0000 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll") Region: id = 421 start_va = 0x72480000 end_va = 0x72493fff entry_point = 0x72480000 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll") Region: id = 422 start_va = 0x8f20000 end_va = 0x901ffff entry_point = 0x0 region_type = private name = "private_0x0000000008f20000" filename = "" Region: id = 423 start_va = 0x6d470000 end_va = 0x6d515fff entry_point = 0x6d470000 region_type = mapped_file name = "mssvp.dll" filename = "\\Windows\\System32\\mssvp.dll" (normalized: "c:\\windows\\system32\\mssvp.dll") Region: id = 424 start_va = 0x6d8c0000 end_va = 0x6d8d5fff entry_point = 0x6d8c0000 region_type = mapped_file name = "mapi32.dll" filename = "\\Windows\\System32\\mapi32.dll" (normalized: "c:\\windows\\system32\\mapi32.dll") Region: id = 425 start_va = 0x7ff88000 end_va = 0x7ff88fff entry_point = 0x0 region_type = private name = "private_0x000000007ff88000" filename = "" Region: id = 426 start_va = 0x741b0000 end_va = 0x741befff entry_point = 0x741b0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 427 start_va = 0x4bc0000 end_va = 0x4bc1fff entry_point = 0x4bc0000 region_type = mapped_file name = "mssvp.dll.mui" filename = "\\Windows\\System32\\en-US\\mssvp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mssvp.dll.mui") Region: id = 428 start_va = 0x741c0000 end_va = 0x741c8fff entry_point = 0x741c0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 429 start_va = 0x4bd0000 end_va = 0x4bd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004bd0000" filename = "" Region: id = 430 start_va = 0x6d230000 end_va = 0x6d467fff entry_point = 0x6d230000 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\System32\\wpdshext.dll" (normalized: "c:\\windows\\system32\\wpdshext.dll") Region: id = 431 start_va = 0x4be0000 end_va = 0x4be1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004be0000" filename = "" Region: id = 432 start_va = 0x710b0000 end_va = 0x71138fff entry_point = 0x710b0000 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 433 start_va = 0x70450000 end_va = 0x7049dfff entry_point = 0x70450000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 434 start_va = 0x62b60000 end_va = 0x62dc6fff entry_point = 0x62b60000 region_type = mapped_file name = "wmvcore.dll" filename = "\\Windows\\System32\\WMVCORE.DLL" (normalized: "c:\\windows\\system32\\wmvcore.dll") Region: id = 435 start_va = 0x6d1b0000 end_va = 0x6d1ecfff entry_point = 0x6d1b0000 region_type = mapped_file name = "wmasf.dll" filename = "\\Windows\\System32\\WMASF.DLL" (normalized: "c:\\windows\\system32\\wmasf.dll") Region: id = 436 start_va = 0x6d1f0000 end_va = 0x6d22efff entry_point = 0x6d1f0000 region_type = mapped_file name = "audiodev.dll" filename = "\\Windows\\System32\\audiodev.dll" (normalized: "c:\\windows\\system32\\audiodev.dll") Region: id = 437 start_va = 0x6d000000 end_va = 0x6d021fff entry_point = 0x6d000000 region_type = mapped_file name = "ehstorapi.dll" filename = "\\Windows\\System32\\EhStorAPI.dll" (normalized: "c:\\windows\\system32\\ehstorapi.dll") Region: id = 438 start_va = 0x4bf0000 end_va = 0x4bf1fff entry_point = 0x0 region_type = private name = "private_0x0000000004bf0000" filename = "" Region: id = 439 start_va = 0x4c00000 end_va = 0x4c08fff entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 440 start_va = 0x4c10000 end_va = 0x4c12fff entry_point = 0x0 region_type = private name = "private_0x0000000004c10000" filename = "" Region: id = 441 start_va = 0x4c20000 end_va = 0x4c20fff entry_point = 0x0 region_type = private name = "private_0x0000000004c20000" filename = "" Region: id = 442 start_va = 0x4c30000 end_va = 0x4c32fff entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 443 start_va = 0x85f0000 end_va = 0x86effff entry_point = 0x0 region_type = private name = "private_0x00000000085f0000" filename = "" Region: id = 444 start_va = 0x8950000 end_va = 0x8a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000008950000" filename = "" Region: id = 445 start_va = 0x9020000 end_va = 0x911ffff entry_point = 0x0 region_type = private name = "private_0x0000000009020000" filename = "" Region: id = 446 start_va = 0x6e700000 end_va = 0x6e724fff entry_point = 0x6e700000 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 447 start_va = 0x750e0000 end_va = 0x750f6fff entry_point = 0x750e0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 448 start_va = 0x7ff86000 end_va = 0x7ff86fff entry_point = 0x0 region_type = private name = "private_0x000000007ff86000" filename = "" Region: id = 449 start_va = 0x7ff87000 end_va = 0x7ff87fff entry_point = 0x0 region_type = private name = "private_0x000000007ff87000" filename = "" Region: id = 450 start_va = 0x747f0000 end_va = 0x74814fff entry_point = 0x747f0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 451 start_va = 0x4c40000 end_va = 0x4c43fff entry_point = 0x4c40000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 452 start_va = 0x8cd0000 end_va = 0x8dcffff entry_point = 0x0 region_type = private name = "private_0x0000000008cd0000" filename = "" Region: id = 453 start_va = 0x9120000 end_va = 0xd11ffff entry_point = 0x0 region_type = private name = "private_0x0000000009120000" filename = "" Region: id = 454 start_va = 0xd210000 end_va = 0xd30ffff entry_point = 0x0 region_type = private name = "private_0x000000000d210000" filename = "" Region: id = 455 start_va = 0x6d290000 end_va = 0x6d361fff entry_point = 0x6d290000 region_type = mapped_file name = "acewstr.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\1033\\acewstr.dll") Region: id = 456 start_va = 0x6d370000 end_va = 0x6d518fff entry_point = 0x6d370000 region_type = mapped_file name = "acecore.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\acecore.dll") Region: id = 457 start_va = 0x7ff84000 end_va = 0x7ff84fff entry_point = 0x0 region_type = private name = "private_0x000000007ff84000" filename = "" Region: id = 458 start_va = 0x7ff85000 end_va = 0x7ff85fff entry_point = 0x0 region_type = private name = "private_0x000000007ff85000" filename = "" Region: id = 459 start_va = 0x2190000 end_va = 0x219ffff entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 460 start_va = 0x6c8e0000 end_va = 0x6cb5dfff entry_point = 0x6c8e0000 region_type = mapped_file name = "vbe7.dll" filename = "\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\progra~1\\common~1\\micros~1\\vba\\vba7.1\\vbe7.dll") Region: id = 461 start_va = 0xd310000 end_va = 0xd52cfff entry_point = 0xd310000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 462 start_va = 0xd310000 end_va = 0xd52cfff entry_point = 0xd310000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 463 start_va = 0x6d060000 end_va = 0x6d28dfff entry_point = 0x6d060000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 464 start_va = 0x21a0000 end_va = 0x21a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021a0000" filename = "" Region: id = 465 start_va = 0x21e0000 end_va = 0x21effff entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 466 start_va = 0x74bf0000 end_va = 0x74c15fff entry_point = 0x74bf0000 region_type = mapped_file name = "vbe7intl.dll" filename = "\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" (normalized: "c:\\progra~1\\common~1\\micros~1\\vba\\vba7.1\\1033\\vbe7intl.dll") Region: id = 467 start_va = 0x2200000 end_va = 0x2209fff entry_point = 0x2200000 region_type = mapped_file name = "normnfd.nls" filename = "\\Windows\\System32\\normnfd.nls" (normalized: "c:\\windows\\system32\\normnfd.nls") Region: id = 468 start_va = 0x52c0000 end_va = 0x5364fff entry_point = 0x52c0000 region_type = mapped_file name = "msacc.olb" filename = "\\Program Files\\Microsoft Office\\Office15\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office15\\msacc.olb") Region: id = 469 start_va = 0xd470000 end_va = 0xd86ffff entry_point = 0x0 region_type = private name = "private_0x000000000d470000" filename = "" Region: id = 470 start_va = 0x6fc00000 end_va = 0x6fc9afff entry_point = 0x6fc00000 region_type = mapped_file name = "acees.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\acees.dll") Region: id = 471 start_va = 0x2440000 end_va = 0x2440fff entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 472 start_va = 0x7410000 end_va = 0x74bafff entry_point = 0x7410000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 473 start_va = 0x7860000 end_va = 0x7930fff entry_point = 0x0 region_type = private name = "private_0x0000000007860000" filename = "" Region: id = 474 start_va = 0x74be0000 end_va = 0x74be9fff entry_point = 0x74be0000 region_type = mapped_file name = "aceerr.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\aceerr.dll") Region: id = 475 start_va = 0x6ec10000 end_va = 0x6ec42fff entry_point = 0x6ec10000 region_type = mapped_file name = "aceintl.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\1033\\aceintl.dll") Region: id = 476 start_va = 0x2330000 end_va = 0x2330fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002330000" filename = "" Region: id = 477 start_va = 0xd370000 end_va = 0xd46ffff entry_point = 0x0 region_type = private name = "private_0x000000000d370000" filename = "" Region: id = 478 start_va = 0x2970000 end_va = 0x2983fff entry_point = 0x2970000 region_type = mapped_file name = "vbe7.dll" filename = "\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\progra~1\\common~1\\micros~1\\vba\\vba7.1\\vbe7.dll") Region: id = 479 start_va = 0x2990000 end_va = 0x2993fff entry_point = 0x2990000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 480 start_va = 0xd8d0000 end_va = 0xd9cffff entry_point = 0x0 region_type = private name = "private_0x000000000d8d0000" filename = "" Region: id = 481 start_va = 0x6ebe0000 end_va = 0x6ec00fff entry_point = 0x6ebe0000 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx") Region: id = 482 start_va = 0x7ff83000 end_va = 0x7ff83fff entry_point = 0x0 region_type = private name = "private_0x000000007ff83000" filename = "" Region: id = 483 start_va = 0x6d8b0000 end_va = 0x6d8d9fff entry_point = 0x6d8b0000 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll") Region: id = 484 start_va = 0x2e70000 end_va = 0x2e7bfff entry_point = 0x2e70000 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx") Region: id = 485 start_va = 0x2e80000 end_va = 0x2e80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002e80000" filename = "" Region: id = 486 start_va = 0xdba0000 end_va = 0xdc9ffff entry_point = 0x0 region_type = private name = "private_0x000000000dba0000" filename = "" Region: id = 487 start_va = 0x74bc0000 end_va = 0x74bc9fff entry_point = 0x74bc0000 region_type = mapped_file name = "msostyle.dll" filename = "\\Program Files\\Microsoft Office\\Office15\\MSOSTYLE.DLL" (normalized: "c:\\program files\\microsoft office\\office15\\msostyle.dll") Region: id = 488 start_va = 0x7ff82000 end_va = 0x7ff82fff entry_point = 0x0 region_type = private name = "private_0x000000007ff82000" filename = "" Region: id = 489 start_va = 0x2e90000 end_va = 0x2e90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002e90000" filename = "" Region: id = 619 start_va = 0x2e90000 end_va = 0x2e90fff entry_point = 0x0 region_type = private name = "private_0x0000000002e90000" filename = "" Region: id = 620 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 621 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 622 start_va = 0x30e0000 end_va = 0x30fcfff entry_point = 0x0 region_type = private name = "private_0x00000000030e0000" filename = "" Region: id = 623 start_va = 0x37a0000 end_va = 0x37e0fff entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 624 start_va = 0x8bc0000 end_va = 0x8c51fff entry_point = 0x0 region_type = private name = "private_0x0000000008bc0000" filename = "" Region: id = 2436 start_va = 0x5de0000 end_va = 0x5edffff entry_point = 0x0 region_type = private name = "private_0x0000000005de0000" filename = "" Region: id = 2437 start_va = 0x7ff82000 end_va = 0x7ff82fff entry_point = 0x0 region_type = private name = "private_0x000000007ff82000" filename = "" Region: id = 2438 start_va = 0x5ee0000 end_va = 0x63e0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ee0000" filename = "" Region: id = 2439 start_va = 0x63f0000 end_va = 0x68f0fff entry_point = 0x0 region_type = private name = "private_0x00000000063f0000" filename = "" Region: id = 2440 start_va = 0xd9d0000 end_va = 0xded0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9d0000" filename = "" Region: id = 2489 start_va = 0x75eb0000 end_va = 0x75eb2fff entry_point = 0x75eb0000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2533 start_va = 0x747f0000 end_va = 0x74814fff entry_point = 0x747f0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Thread: id = 1 os_tid = 0xe8c Thread: id = 2 os_tid = 0xe88 Thread: id = 3 os_tid = 0xe84 Thread: id = 4 os_tid = 0xe80 Thread: id = 5 os_tid = 0xe7c Thread: id = 6 os_tid = 0xe78 Thread: id = 7 os_tid = 0xe74 Thread: id = 8 os_tid = 0xe70 Thread: id = 9 os_tid = 0xe50 Thread: id = 10 os_tid = 0xe4c Thread: id = 11 os_tid = 0xe48 Thread: id = 12 os_tid = 0xe44 Thread: id = 13 os_tid = 0xe40 Thread: id = 14 os_tid = 0xe3c Thread: id = 15 os_tid = 0xe38 [0041.712] GetTickCount () returned 0xa63fc1 [0041.713] StringFromCLSID (in: rclsid=0x437f5fc*(Data1=0x2b88c4f2, Data2=0xea8f, Data3=0x43cd, Data4=([0]=0x80, [1]=0x5e, [2]=0x4d, [3]=0x41, [4]=0x34, [5]=0x6e, [6]=0x18, [7]=0xa7)), lplpsz=0x437f5f4 | out: lplpsz=0x437f5f4*="{2B88C4F2-EA8F-43CD-805E-4D41346E18A7}") returned 0x0 [0041.713] CoTaskMemFree (pv=0x5901a28) Thread: id = 16 os_tid = 0xe30 Thread: id = 17 os_tid = 0xe2c Thread: id = 18 os_tid = 0xe24 [0035.136] _malloc_crt () returned 0x43837e0 [0035.136] __dllonexit () returned 0x75ce9e3a [0035.136] __dllonexit () returned 0xf1ce9e48 [0035.136] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0035.140] __dllonexit () returned 0x5dce9e3a [0035.142] __dllonexit () returned 0x79ce9e67 [0035.142] __dllonexit () returned 0x5ce9e3a [0035.142] __dllonexit () returned 0xedce9e3b [0035.143] __dllonexit () returned 0xd5ce9e3b [0035.143] __dllonexit () returned 0xbdce9e3b [0035.143] __dllonexit () returned 0x65ce9e3b [0035.144] __dllonexit () returned 0x4dce9e3b [0035.144] __dllonexit () returned 0x35ce9e3b [0035.144] __dllonexit () returned 0x1dce9e3b [0035.144] __dllonexit () returned 0xc5ce9e34 [0035.145] __dllonexit () returned 0xadce9e34 [0035.145] __dllonexit () returned 0x95ce9e34 [0035.145] __dllonexit () returned 0x7dce9e34 [0035.145] __dllonexit () returned 0x25ce9e34 [0035.146] __dllonexit () returned 0x19ce9e4b [0035.146] __dllonexit () returned 0xdce9e34 [0035.146] __dllonexit () returned 0xf5ce9e35 [0035.146] __dllonexit () returned 0x49ce9e6a [0035.147] __dllonexit () returned 0x29ce9e68 [0035.147] __dllonexit () returned 0xddce9e35 [0035.147] __dllonexit () returned 0x85ce9e35 [0035.147] DisableThreadLibraryCalls (hLibModule=0x6c8e0000) returned 1 [0035.147] GetVersion () returned 0x1db10106 [0035.147] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0035.147] GetUserDefaultLCID () returned 0x409 [0035.147] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0035.148] GetSystemMetrics (nIndex=5) returned 1 [0035.148] GetSystemMetrics (nIndex=6) returned 1 [0035.148] GetSystemMetrics (nIndex=11) returned 32 [0035.148] GetSystemMetrics (nIndex=12) returned 32 [0035.148] GetSystemMetrics (nIndex=34) returned 132 [0035.148] GetSystemMetrics (nIndex=35) returned 38 [0035.148] GetSystemMetrics (nIndex=0) returned 1440 [0035.148] GetSystemMetrics (nIndex=1) returned 900 [0035.148] GetSystemMetrics (nIndex=32) returned 4 [0035.148] GetSystemMetrics (nIndex=33) returned 4 [0035.148] GetSystemMetrics (nIndex=4) returned 22 [0035.148] GetSystemMetrics (nIndex=42) returned 0 [0035.148] GetStockObject (i=15) returned 0x188000b [0035.148] GetStockObject (i=7) returned 0x1b00017 [0035.148] GetStockObject (i=6) returned 0x1b00018 [0035.148] GetStockObject (i=8) returned 0x1b00016 [0035.148] GetStockObject (i=4) returned 0x1900011 [0035.148] GetStockObject (i=2) returned 0x1900012 [0035.148] GetStockObject (i=0) returned 0x1900010 [0035.148] GetStockObject (i=5) returned 0x1900015 [0035.148] GetStockObject (i=13) returned 0x18a002e [0035.148] GetDC (hWnd=0x0) returned 0x6010898 [0035.148] GetDeviceCaps (hdc=0x6010898, index=14) returned 1 [0035.148] GetDeviceCaps (hdc=0x6010898, index=12) returned 32 [0035.148] GetDeviceCaps (hdc=0x6010898, index=88) returned 96 [0035.148] GetDeviceCaps (hdc=0x6010898, index=90) returned 96 [0035.148] GetDeviceCaps (hdc=0x6010898, index=38) returned 32409 [0035.148] ReleaseDC (hWnd=0x0, hDC=0x6010898) returned 1 [0035.148] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x6cb1a228 | out: ppMalloc=0x6cb1a228*=0x773f66bc) returned 0x0 [0035.151] GetModuleHandleA (lpModuleName=0x0) returned 0x3c0000 [0035.151] RegisterClassA (lpWndClass=0x2a4c4c) returned 0x4e9c076 [0035.151] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0035.151] SetCursor (hCursor=0x10007) returned 0x10007 [0035.151] _set_invalid_parameter_handler (_Handler=0x6c8ed4b8) returned 0x0 [0035.152] wcscpy_s (in: _Destination=0x5bb86f4, _SizeInWords=0xb, _Source="7.1\\" | out: _Destination="7.1\\") returned 0x0 [0035.152] wcscpy_s (in: _Destination=0x5bb86fc, _SizeInWords=0x7, _Source="Common" | out: _Destination="Common") returned 0x0 [0035.152] GetACP () returned 0x4e4 [0035.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft Access Databases (*.accdb)", cchWideChar=163, lpMultiByteStr=0x4381558, cbMultiByte=326, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Access Databases (*.accdb)", lpUsedDefaultChar=0x0) returned 163 [0035.154] GetModuleHandleExA (in: dwFlags=0x0, lpModuleName="MSI.DLL", phModule=0x6cb20ffc | out: phModule=0x6cb20ffc*=0x72f50000) returned 1 [0035.155] GetProcAddress (hModule=0x72f50000, lpProcName="MsiProvideQualifiedComponentA") returned 0x72f7c331 [0035.155] GetProcAddress (hModule=0x72f50000, lpProcName="MsiGetProductCodeA") returned 0x72f7ea84 [0035.155] GetProcAddress (hModule=0x72f50000, lpProcName="MsiReinstallFeatureA") returned 0x73001cf6 [0035.155] GetProcAddress (hModule=0x72f50000, lpProcName="MsiProvideComponentA") returned 0x7300f5d1 [0035.157] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43 [0035.157] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43 [0035.157] lstrcpyW (in: lpString1=0x2a4914, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" [0035.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", cchWideChar=-1, lpMultiByteStr=0x2a4b1c, cbMultiByte=135, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", lpUsedDefaultChar=0x0) returned 68 [0035.157] GetModuleHandleA (lpModuleName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x0 [0035.809] LoadLibraryExA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", hFile=0x0, dwFlags=0x8) returned 0x6d060000 [0035.871] GetLastError () returned 0x0 [0035.871] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoVBADigSigCallDlg@20") returned 0x6d18fe80 [0035.871] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoVbaInitSecurity@4") returned 0x6d118951 [0035.872] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFIEPolicyAndVersion@8") returned 0x6d10cd31 [0035.872] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFAnsiCodePageSupportsLCID@8") returned 0x6d11882e [0035.872] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFInitOffice@20") returned 0x6d10cd4b [0035.872] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoUninitOffice@4") returned 0x6d0c96db [0035.873] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFGetFontSettings@20") returned 0x6d0c1af9 [0035.873] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoRgchToRgwch@16") returned 0x6d0c9bae [0035.873] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoHrSimpleQueryInterface@16") returned 0x6d0c34e1 [0035.874] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoHrSimpleQueryInterface2@20") returned 0x6d0c3523 [0035.874] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFCreateControl@36") returned 0x6d0c4a26 [0035.874] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFLongLoad@8") returned 0x6d1c1250 [0035.874] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFLongSave@8") returned 0x6d1c1259 [0035.875] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFGetTooltips@0") returned 0x6d0fdfac [0035.875] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFSetTooltips@4") returned 0x6d122845 [0035.875] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFLoadToolbarSet@24") returned 0x6d10dd8b [0035.875] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFCreateToolbarSet@28") returned 0x6d0c23c9 [0035.876] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoHpalOffice@0") returned 0x6d0cc568 [0035.876] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFWndProcNeeded@4") returned 0x6d0c18d2 [0035.876] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFWndProc@24") returned 0x6d0c2a70 [0035.877] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFCreateITFCHwnd@20") returned 0x6d0c1925 [0035.877] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoDestroyITFC@4") returned 0x6d0c958b [0035.877] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFPitbsFromHwndAndMsg@12") returned 0x6d0c8820 [0035.877] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFGetComponentManager@4") returned 0x6d0c35a4 [0035.878] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoMultiByteToWideChar@24") returned 0x6d0cac03 [0035.878] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoWideCharToMultiByte@32") returned 0x6d0c4d33 [0035.878] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoHrRegisterAll@0") returned 0x6d18f8b6 [0035.878] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFSetComponentManager@4") returned 0x6d0cc179 [0035.879] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFCreateStdComponentManager@20") returned 0x6d0c19d5 [0035.879] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFHandledMessageNeeded@4") returned 0x6d0c6736 [0035.879] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoPeekMessage@8") returned 0x6d0c649f [0035.879] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFCreateIPref@28") returned 0x6d0bf9cf [0035.880] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoDestroyIPref@4") returned 0x6d0c9320 [0035.880] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoChsFromLid@4") returned 0x6d0bf864 [0035.880] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoCpgFromChs@4") returned 0x6d0c1cc5 [0035.881] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoSetLocale@4") returned 0x6d0bf984 [0035.881] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoFSetHMsoinstOfSdm@4") returned 0x6d0c198e [0035.881] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoSetVbaInterfaces@8") returned 0x6d18ff8d [0035.881] GetProcAddress (hModule=0x6d060000, lpProcName="_MsoGetControlInstanceId@8") returned 0x6d1686e7 [0035.882] RegisterClipboardFormatA (lpszFormat="VBM_FHwndIsHctl") returned 0xc1bd [0035.883] lstrlenA (lpString="") returned 0 [0035.883] lstrcpyA (in: lpString1=0x131e138, lpString2="" | out: lpString1="") returned="" [0035.883] GetEnvironmentVariableA (in: lpName="DDRYBUR", lpBuffer=0x2a49e4, nSize=0x118 | out: lpBuffer="\x10") returned 0x0 [0035.883] SetErrorMode (uMode=0x8001) returned 0x8001 [0035.883] GetModuleFileNameA (in: hModule=0x6c8e0000, lpFilename=0x2a4714, nSize=0x104 | out: lpFilename="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\progra~1\\common~1\\micros~1\\vba\\vba7.1\\vbe7.dll")) returned 0x31 [0035.883] lstrcpyA (in: lpString1=0x2a4610, lpString2="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" | out: lpString1="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\") returned="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" [0035.883] lstrcpyA (in: lpString1=0x2a4610, lpString2="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" | out: lpString1="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\") returned="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" [0035.883] lstrcpyA (in: lpString1=0x2a4610, lpString2="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" | out: lpString1="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\") returned="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" [0035.883] lstrcpyA (in: lpString1=0x2a4610, lpString2="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" | out: lpString1="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\") returned="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" [0035.883] lstrcpyA (in: lpString1=0x2a4610, lpString2="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" | out: lpString1="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\") returned="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" [0035.883] lstrcpyA (in: lpString1=0x2a4610, lpString2="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" | out: lpString1="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\") returned="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\" [0035.883] strcpy_s (in: _Dst=0x2a4818, _DstSize=0x200, _Src="VBE7INTL.DLL" | out: _Dst="VBE7INTL.DLL") returned 0x0 [0035.883] _ultoa_s (in: _Val=0x409, _DstBuf=0x2a45dc, _Size=0x6, _Radix=10 | out: _DstBuf="1033") returned 0x0 [0035.883] strcat_s (in: _Destination="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\", _SizeInBytes=0x104, _Source="1033" | out: _Destination="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033") returned 0x0 [0035.883] strcat_s (in: _Destination="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033", _SizeInBytes=0x104, _Source="\\" | out: _Destination="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\") returned 0x0 [0035.883] strcat_s (in: _Destination="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\", _SizeInBytes=0x104, _Source="VBE7INTL.DLL" | out: _Destination="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x0 [0035.883] lstrlenA (lpString="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 58 [0035.883] CharToOemBuffA (in: lpszSrc="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL", lpszDst=0x2a42b4, cchDstLength=0x3b | out: lpszDst="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 1 [0035.883] _access_s (_FileName="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL", _AccessMode=0) returned 0x0 [0035.886] strcpy_s (in: _Dst=0x2a44e8, _DstSize=0x104, _Src="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" | out: _Dst="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x0 [0035.886] LoadLibraryA (lpLibFileName="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x74bf0000 [0035.889] GetSystemDefaultLCID () returned 0x409 [0035.889] GetUserDefaultLCID () returned 0x409 [0035.889] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x2a4b18, cchData=2 | out: lpLCData=".") returned 2 [0035.889] GetStockObject (i=13) returned 0x18a002e [0035.889] GetObjectA (in: h=0x18a002e, c=60, pv=0x2a4adc | out: pv=0x2a4adc) returned 60 [0035.889] lstrcpyA (in: lpString1=0x6cb21658, lpString2="Vbui6.chm" | out: lpString1="Vbui6.chm") returned="Vbui6.chm" [0035.889] lstrcpyA (in: lpString1=0x6cb20c88, lpString2="VbLR6.chm" | out: lpString1="VbLR6.chm") returned="VbLR6.chm" [0035.889] GetModuleFileNameA (in: hModule=0x6c8e0000, lpFilename=0x2a4b34, nSize=0x104 | out: lpFilename="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\progra~1\\common~1\\micros~1\\vba\\vba7.1\\vbe7.dll")) returned 0x31 [0035.892] lstrlenA (lpString="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL") returned 49 [0035.892] lstrcpyA (in: lpString1=0x4380940, lpString2="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" | out: lpString1="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL") returned="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" [0035.892] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x2a490c | out: lpBuffer="C:\\Users\\JPenUM\\Desktop") returned 0x17 [0035.892] GetVersionExA (in: lpVersionInformation=0x2a4a6c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x62, dwMinorVersion=0x31, dwBuildNumber=0x5a35b38, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2a4a6c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0035.892] RegOpenKeyA (in: hKey=0x80000000, lpSubKey="Licenses", phkResult=0x2a49c4 | out: phkResult=0x2a49c4*=0x652) returned 0x0 [0035.892] strcpy_s (in: _Dst=0x2a4a90, _DstSize=0x80, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0 [0035.892] strcpy_s (in: _Dst=0x2a49c8, _DstSize=0xc8, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0 [0035.892] _strrev (in: _Str="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Str="7E25578F0000-E3CB-1d11-377B-B8554088") returned="7E25578F0000-E3CB-1d11-377B-B8554088" [0035.892] RegQueryValueA (in: hKey=0x652, lpSubKey="8804558B-B773-11d1-BC3E-0000F87552E7", lpData=0x2a49c8, lpcbData=0x2a49c0 | out: lpData="\x0f}\x02\x01", lpcbData=0x2a49c0) returned 0x2 [0035.892] RegCloseKey (hKey=0x652) returned 0x0 [0035.892] OleInitialize (pvReserved=0x0) returned 0x1 [0035.893] OaBuildVersion () returned 0x321396 [0035.893] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x75e00000 [0035.893] GetLastError () returned 0x0 [0035.893] GetProcAddress (hModule=0x75e00000, lpProcName="SysFreeString") returned 0x75e03e59 [0035.893] GetProcAddress (hModule=0x75e00000, lpProcName="LoadTypeLib") returned 0x75e10aa2 [0035.894] GetProcAddress (hModule=0x75e00000, lpProcName="RegisterTypeLib") returned 0x75e21ea6 [0035.894] GetProcAddress (hModule=0x75e00000, lpProcName="QueryPathOfRegTypeLib") returned 0x75e3351b [0035.894] GetProcAddress (hModule=0x75e00000, lpProcName="UnRegisterTypeLib") returned 0x75e31ca9 [0035.895] GetProcAddress (hModule=0x75e00000, lpProcName="OleTranslateColor") returned 0x75e326fa [0035.895] GetProcAddress (hModule=0x75e00000, lpProcName="OleCreateFontIndirect") returned 0x75e2352f [0035.895] GetProcAddress (hModule=0x75e00000, lpProcName="OleCreatePictureIndirect") returned 0x75e23df8 [0035.895] GetProcAddress (hModule=0x75e00000, lpProcName="OleLoadPicture") returned 0x75e67c49 [0035.896] GetProcAddress (hModule=0x75e00000, lpProcName="OleCreatePropertyFrameIndirect") returned 0x75e693fc [0035.896] GetProcAddress (hModule=0x75e00000, lpProcName="OleCreatePropertyFrame") returned 0x75e6944a [0035.896] GetProcAddress (hModule=0x75e00000, lpProcName="OleIconToCursor") returned 0x75e6776e [0035.896] GetProcAddress (hModule=0x75e00000, lpProcName="LoadTypeLibEx") returned 0x75e107b7 [0035.897] GetProcAddress (hModule=0x75e00000, lpProcName="OleLoadPictureEx") returned 0x75e670a1 [0035.897] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0035.897] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0035.897] GetClassInfoA (in: hInstance=0x6c8e0000, lpClassName="VBBubble", lpWndClass=0x2a4ad8 | out: lpWndClass=0x2a4ad8) returned 0 [0035.897] RegisterClassA (lpWndClass=0x2a4ad8) returned 0x166c1be [0035.897] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Count") returned 0x107630 [0035.897] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="_Default") returned 0x10c26a [0035.897] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Item") returned 0x107ad7 [0035.897] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Add") returned 0x1072f7 [0035.897] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Remove") returned 0x10b1cf [0035.897] GlobalAddAtomA (lpString="VBDisabled") returned 0xc154 [0035.897] RegisterClassExA (param_1=0x2a4bf4) returned 0x2c1bf [0035.898] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderMain", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x6c8e0000, lpParam=0x0) returned 0x2026e [0035.898] DefWindowProcA (hWnd=0x2026e, Msg=0x81, wParam=0x0, lParam=0x2a47d8) returned 0x1 [0035.898] DefWindowProcA (hWnd=0x2026e, Msg=0x83, wParam=0x0, lParam=0x2a4814) returned 0x0 [0035.899] DefWindowProcA (hWnd=0x2026e, Msg=0x1, wParam=0x0, lParam=0x2a47d8) returned 0x0 [0035.899] DefWindowProcA (hWnd=0x2026e, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0035.899] DefWindowProcA (hWnd=0x2026e, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0035.899] GetVersionExA (in: lpVersionInformation=0x2a4ae4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2a4ae4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0035.899] GetModuleHandleA (lpModuleName="USER32") returned 0x75d30000 [0035.899] GetProcAddress (hModule=0x75d30000, lpProcName="GetSystemMetrics") returned 0x75d467cf [0035.900] GetProcAddress (hModule=0x75d30000, lpProcName="MonitorFromWindow") returned 0x75d43622 [0035.900] GetProcAddress (hModule=0x75d30000, lpProcName="MonitorFromRect") returned 0x75d40ca1 [0035.900] GetProcAddress (hModule=0x75d30000, lpProcName="MonitorFromPoint") returned 0x75d394c9 [0035.900] GetProcAddress (hModule=0x75d30000, lpProcName="EnumDisplayMonitors") returned 0x75d434a3 [0035.901] GetProcAddress (hModule=0x75d30000, lpProcName="GetMonitorInfoA") returned 0x75d3c34e [0035.901] GetProcAddress (hModule=0x75d30000, lpProcName="EnumDisplayDevicesA") returned 0x75d3c204 [0035.901] SetWindowPos (hWnd=0x2026e, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0035.901] DefWindowProcA (hWnd=0x2026e, Msg=0x46, wParam=0x0, lParam=0x2a4ba0) returned 0x0 [0035.901] DefWindowProcA (hWnd=0x2026e, Msg=0x47, wParam=0x0, lParam=0x2a4ba0) returned 0x0 [0035.901] DefWindowProcA (hWnd=0x2026e, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0 [0035.901] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe24 [0035.901] GetVersion () returned 0x1db10106 [0035.902] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x75e00000 [0035.902] GetProcAddress (hModule=0x75e00000, lpProcName="DispCallFunc") returned 0x75e13dcf [0035.902] GetProcAddress (hModule=0x75e00000, lpProcName="LoadTypeLibEx") returned 0x75e107b7 [0035.902] GetProcAddress (hModule=0x75e00000, lpProcName="UnRegisterTypeLib") returned 0x75e31ca9 [0035.903] GetProcAddress (hModule=0x75e00000, lpProcName="CreateTypeLib2") returned 0x75e18e70 [0035.903] GetProcAddress (hModule=0x75e00000, lpProcName="VarDateFromUdate") returned 0x75e17684 [0035.903] GetProcAddress (hModule=0x75e00000, lpProcName="VarUdateFromDate") returned 0x75e1cc98 [0035.904] GetProcAddress (hModule=0x75e00000, lpProcName="GetAltMonthNames") returned 0x75e4903a [0035.904] GetProcAddress (hModule=0x75e00000, lpProcName="VarNumFromParseNum") returned 0x75e16231 [0035.904] GetProcAddress (hModule=0x75e00000, lpProcName="VarParseNumFromStr") returned 0x75e15fea [0035.904] GetProcAddress (hModule=0x75e00000, lpProcName="VarDecFromR4") returned 0x75e23f94 [0035.905] GetProcAddress (hModule=0x75e00000, lpProcName="VarDecFromR8") returned 0x75e24e9e [0035.905] GetProcAddress (hModule=0x75e00000, lpProcName="VarDecFromDate") returned 0x75e4db72 [0035.905] GetProcAddress (hModule=0x75e00000, lpProcName="VarDecFromI4") returned 0x75e32a8c [0035.905] GetProcAddress (hModule=0x75e00000, lpProcName="VarDecFromCy") returned 0x75e4d737 [0035.906] GetProcAddress (hModule=0x75e00000, lpProcName="VarR4FromDec") returned 0x75e4e015 [0035.906] GetProcAddress (hModule=0x75e00000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x75e4cc3d [0035.906] GetProcAddress (hModule=0x75e00000, lpProcName="GetRecordInfoFromGuids") returned 0x75e4d1c4 [0035.906] GetProcAddress (hModule=0x75e00000, lpProcName="SafeArrayGetRecordInfo") returned 0x75e4d48c [0035.907] GetProcAddress (hModule=0x75e00000, lpProcName="SafeArraySetRecordInfo") returned 0x75e4d4c6 [0035.907] GetProcAddress (hModule=0x75e00000, lpProcName="SafeArrayGetIID") returned 0x75e4d509 [0035.907] GetProcAddress (hModule=0x75e00000, lpProcName="SafeArraySetIID") returned 0x75e1e7bb [0035.908] GetProcAddress (hModule=0x75e00000, lpProcName="SafeArrayCopyData") returned 0x75e1e496 [0035.908] GetProcAddress (hModule=0x75e00000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x75e1ddf1 [0035.908] GetProcAddress (hModule=0x75e00000, lpProcName="SafeArrayCreateEx") returned 0x75e4d53f [0035.908] GetProcAddress (hModule=0x75e00000, lpProcName="VarFormat") returned 0x75e52055 [0035.909] GetProcAddress (hModule=0x75e00000, lpProcName="VarFormatDateTime") returned 0x75e520ea [0035.909] GetProcAddress (hModule=0x75e00000, lpProcName="VarFormatNumber") returned 0x75e52151 [0035.909] GetProcAddress (hModule=0x75e00000, lpProcName="VarFormatPercent") returned 0x75e521f5 [0035.909] GetProcAddress (hModule=0x75e00000, lpProcName="VarFormatCurrency") returned 0x75e52288 [0035.910] GetProcAddress (hModule=0x75e00000, lpProcName="VarWeekdayName") returned 0x75e52335 [0035.910] GetProcAddress (hModule=0x75e00000, lpProcName="VarMonthName") returned 0x75e523d5 [0035.910] GetProcAddress (hModule=0x75e00000, lpProcName="VarAdd") returned 0x75e25934 [0035.910] GetProcAddress (hModule=0x75e00000, lpProcName="VarAnd") returned 0x75e25a98 [0035.911] GetProcAddress (hModule=0x75e00000, lpProcName="VarCat") returned 0x75e259b4 [0035.911] GetProcAddress (hModule=0x75e00000, lpProcName="VarDiv") returned 0x75e7e405 [0035.911] GetProcAddress (hModule=0x75e00000, lpProcName="VarEqv") returned 0x75e7ef07 [0035.912] GetProcAddress (hModule=0x75e00000, lpProcName="VarIdiv") returned 0x75e7f00a [0035.912] GetProcAddress (hModule=0x75e00000, lpProcName="VarImp") returned 0x75e7ef47 [0035.912] GetProcAddress (hModule=0x75e00000, lpProcName="VarMod") returned 0x75e7f15e [0035.912] GetProcAddress (hModule=0x75e00000, lpProcName="VarMul") returned 0x75e7dbd4 [0035.913] GetProcAddress (hModule=0x75e00000, lpProcName="VarOr") returned 0x75e7ecfa [0035.913] GetProcAddress (hModule=0x75e00000, lpProcName="VarPow") returned 0x75e7ea66 [0035.913] GetProcAddress (hModule=0x75e00000, lpProcName="VarSub") returned 0x75e7d332 [0035.913] GetProcAddress (hModule=0x75e00000, lpProcName="VarXor") returned 0x75e7ee2e [0035.914] GetProcAddress (hModule=0x75e00000, lpProcName="VarAbs") returned 0x75e7ca11 [0035.914] GetProcAddress (hModule=0x75e00000, lpProcName="VarFix") returned 0x75e7cc5f [0035.914] GetProcAddress (hModule=0x75e00000, lpProcName="VarInt") returned 0x75e7cde7 [0035.914] GetProcAddress (hModule=0x75e00000, lpProcName="VarNeg") returned 0x75e7c802 [0035.915] GetProcAddress (hModule=0x75e00000, lpProcName="VarNot") returned 0x75e7ec66 [0035.915] GetProcAddress (hModule=0x75e00000, lpProcName="VarRound") returned 0x75e7d155 [0035.915] GetProcAddress (hModule=0x75e00000, lpProcName="VarCmp") returned 0x75e1b0dc [0035.916] GetProcAddress (hModule=0x75e00000, lpProcName="VarDecAdd") returned 0x75e35f3e [0035.916] GetProcAddress (hModule=0x75e00000, lpProcName="VarDecCmp") returned 0x75e24fd0 [0035.916] GetProcAddress (hModule=0x75e00000, lpProcName="VarBstrCat") returned 0x75e20d2c [0035.916] GetProcAddress (hModule=0x75e00000, lpProcName="VarCyMulI4") returned 0x75e359ed [0035.917] GetProcAddress (hModule=0x75e00000, lpProcName="VarBstrCmp") returned 0x75e0f8b8 [0035.917] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x772b0000 [0035.918] GetProcAddress (hModule=0x772b0000, lpProcName="CoCreateInstanceEx") returned 0x772f9d4e [0035.918] GetProcAddress (hModule=0x772b0000, lpProcName="CLSIDFromProgIDEx") returned 0x772c0782 [0035.918] GetSystemMetrics (nIndex=42) returned 0 [0035.918] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x6cb19088 | out: ppMalloc=0x6cb19088*=0x773f66bc) returned 0x0 [0035.918] IMalloc:Alloc (This=0x773f66bc, cb=0x18) returned 0x599d3c0 [0035.919] GetUserDefaultLCID () returned 0x409 [0035.919] GetUserDefaultLCID () returned 0x409 [0035.919] IsValidCodePage (CodePage=0x3a4) returned 1 [0035.920] IsValidCodePage (CodePage=0x3b5) returned 1 [0035.921] IsValidCodePage (CodePage=0x3b6) returned 1 [0035.922] IsValidCodePage (CodePage=0x3a8) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="぀㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぁ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="あ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぃ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="い㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぅ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="う㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぇ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="え㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぉ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="お㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="か㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="が㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="き㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぎ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="く㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぐ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="け㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="げ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="こ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ご㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="さ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ざ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="し㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="じ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="す㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ず㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="せ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぜ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="そ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぞ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="た㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="だ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ち㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぢ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="っ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="つ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="づ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="て㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="で㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="と㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ど㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="な㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="に㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぬ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ね㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="の㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="は㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ば㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぱ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ひ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="び㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぴ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ふ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぶ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぷ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="へ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="べ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぺ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ほ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぼ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぽ㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ま㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="み㫶", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3080\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3081\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3082\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3083\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3084\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3085\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3086\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3087\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3088\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3089\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x308a\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x308b\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x308c\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x308d\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x308e\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x308f\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3090\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3091\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3092\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3093\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3094\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3095\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3096\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3097\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3098\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x3099\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x309a\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x309b\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x309c\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x309d\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x309e\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x309f\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30a0\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30a1\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30a2\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30a3\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30a4\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30a5\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30a6\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30a7\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30a8\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30a9\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30aa\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ab\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ac\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ad\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ae\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30af\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30b0\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30b1\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30b2\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30b3\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30b4\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30b5\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30b6\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30b7\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30b8\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30b9\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ba\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30bb\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30bc\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30bd\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30be\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30bf\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30c0\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30c1\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30c2\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30c3\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30c4\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30c5\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30c6\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30c7\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30c8\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30c9\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ca\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30cb\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30cc\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30cd\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ce\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30cf\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30d0\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30d1\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30d2\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30d3\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30d4\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30d5\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30d6\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30d7\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30d8\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30d9\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30da\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30db\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30dc\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30dd\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30de\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30df\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30e0\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30e1\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30e2\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30e3\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30e4\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30e5\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30e6\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30e7\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30e8\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30e9\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ea\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30eb\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ec\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ed\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ee\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ef\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30f0\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30f1\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30f2\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30f3\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30f4\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30f5\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30f6\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30f7\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30f8\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30f9\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30fa\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30fb\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30fc\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30fd\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30fe\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0035.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="\x30ff\x3af6", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0035.931] GetUserDefaultLangID () returned 0x409 [0035.931] GetSystemDefaultLangID () returned 0x1490409 [0035.931] GetSystemMetrics (nIndex=42) returned 0 [0035.931] IMalloc:Alloc (This=0x773f66bc, cb=0x3c) returned 0x591c140 [0035.931] IMalloc:Alloc (This=0x773f66bc, cb=0x1c) returned 0x5bb6530 [0035.931] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x58b6538 [0035.936] GetStockObject (i=13) returned 0x18a002e [0035.936] GetObjectA (in: h=0x18a002e, c=60, pv=0x2a4b50 | out: pv=0x2a4b50) returned 60 [0035.936] IMalloc:Alloc (This=0x773f66bc, cb=0x584) returned 0x5ac8e40 [0035.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7.1\\Common", cchWideChar=-1, lpMultiByteStr=0x5ac8e4c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7.1\\Common", lpUsedDefaultChar=0x0) returned 11 [0035.936] IMalloc:Alloc (This=0x773f66bc, cb=0x5c) returned 0x59765d0 [0035.936] VirtualQuery (in: lpAddress=0x2a4c24, lpBuffer=0x2a4c08, dwLength=0x1c | out: lpBuffer=0x2a4c08*(BaseAddress=0x2a4000, AllocationBase=0x1b0000, AllocationProtect=0x4, RegionSize=0xc000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0035.936] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x2a4bf0 | out: phkResult=0x2a4bf0*=0x0) returned 0x2 [0035.936] CreateCompatibleDC (hdc=0x0) returned 0x100109ad [0035.936] GetCurrentObject (hdc=0x100109ad, type=0x7) returned 0x185000f [0035.936] IMalloc:Alloc (This=0x773f66bc, cb=0x18) returned 0x599c8a0 [0035.937] IMalloc:Alloc (This=0x773f66bc, cb=0x1c) returned 0x5bb6508 [0036.824] lstrcmpiW (lpString1="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", lpString2="") returned 1 [0036.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", cchWideChar=-1, lpMultiByteStr=0x2a4560, cbMultiByte=167, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", lpUsedDefaultChar=0x0) returned 84 [0036.825] lstrlenA (lpString="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned 83 [0036.825] lstrcpyA (in: lpString1=0x4381930, lpString2="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" | out: lpString1="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" [0036.825] GetCurrentThreadId () returned 0xe24 [0036.825] GetCurrentThreadId () returned 0xe24 [0036.825] IMalloc:Alloc (This=0x773f66bc, cb=0x4) returned 0x590a178 [0036.825] IMalloc:Alloc (This=0x773f66bc, cb=0xc8) returned 0x58a2938 [0036.825] IMalloc:Alloc (This=0x773f66bc, cb=0x80) returned 0x5a66bd8 [0036.825] IMalloc:Alloc (This=0x773f66bc, cb=0x250) returned 0x5c47f00 [0036.826] IMalloc:Alloc (This=0x773f66bc, cb=0x504) returned 0x5ba56f8 [0036.826] IMalloc:Alloc (This=0x773f66bc, cb=0xce8) returned 0x59fd110 [0036.826] GetLocalTime (in: lpSystemTime=0x2a41b0 | out: lpSystemTime=0x2a41b0*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x1, wDay=0x15, wHour=0xc, wMinute=0x13, wSecond=0x4, wMilliseconds=0x5)) [0036.826] _ultow_s (in: _Value=0x5e244938, _Buffer=0x5c47f1a, _BufferCount=0x103, _Radix=16 | out: _Buffer="5e244938") returned 0x0 [0036.826] wcsncpy_s (in: _Destination=0x2a3f6c, _SizeInWords=0x108, _Source="*\\Z005e244938", _MaxCount=0x106 | out: _Destination="*\\Z005e244938") returned 0x0 [0036.826] CharLowerBuffW (in: lpsz="*\\Z005e244938", cchLength=0xd | out: lpsz="*\\z005e244938") returned 0xd [0036.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005e244938", cchWideChar=14, lpMultiByteStr=0x2a3ee0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005e244938", lpUsedDefaultChar=0x0) returned 14 [0036.826] wcscpy_s (in: _Destination=0x5a66bf0, _SizeInWords=0xe, _Source="*\\Z005e244938" | out: _Destination="*\\Z005e244938") returned 0x0 [0036.826] wcsncpy_s (in: _Destination=0x2a3f80, _SizeInWords=0x108, _Source="*\\Z005e244938", _MaxCount=0x106 | out: _Destination="*\\Z005e244938") returned 0x0 [0036.826] CharLowerBuffW (in: lpsz="*\\Z005e244938", cchLength=0xd | out: lpsz="*\\z005e244938") returned 0xd [0036.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005e244938", cchWideChar=14, lpMultiByteStr=0x2a3ef4, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005e244938", lpUsedDefaultChar=0x0) returned 14 [0036.826] lstrcpyA (in: lpString1=0x4381d48, lpString2="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" | out: lpString1="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" [0036.826] lstrcpyA (in: lpString1=0x4381d48, lpString2="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" | out: lpString1="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" [0036.826] lstrcpyA (in: lpString1=0x4381d48, lpString2="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" | out: lpString1="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" [0036.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4381d48, cbMultiByte=-1, lpWideCharStr=0x2a4420, cchWideChar=84 | out: lpWideCharStr="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned 84 [0036.826] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0036.826] wcscpy_s (in: _Destination=0x2a41fe, _SizeInWords=0x105, _Source="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" | out: _Destination="C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned 0x0 [0036.826] wcsncpy_s (in: _Destination=0x2a3f8c, _SizeInWords=0x108, _Source="*\\Z005e244938", _MaxCount=0x106 | out: _Destination="*\\Z005e244938") returned 0x0 [0036.826] CharLowerBuffW (in: lpsz="*\\Z005e244938", cchLength=0xd | out: lpsz="*\\z005e244938") returned 0xd [0036.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005e244938", cchWideChar=14, lpMultiByteStr=0x2a3f00, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005e244938", lpUsedDefaultChar=0x0) returned 14 [0036.827] _wcsicmp (_String1="*\\Z005e244938", _String2="*\\Z005e244938") returned 0 [0036.827] wcsncpy_s (in: _Destination=0x2a3f80, _SizeInWords=0x108, _Source="*\\CC:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned 0x0 [0036.827] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", cchLength=0x56 | out: lpsz="*\\cc:\\users\\jpenum\\desktop\\october_invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned 0x56 [0036.827] IMalloc:Alloc (This=0x773f66bc, cb=0xae) returned 0x5c457a0 [0036.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\jpenum\\desktop\\october_invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", cchWideChar=87, lpMultiByteStr=0x5c457a0, cbMultiByte=174, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\jpenum\\desktop\\october_invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", lpUsedDefaultChar=0x0) returned 87 [0036.827] IMalloc:Free (This=0x773f66bc, pv=0x5c457a0) [0036.827] wcscpy_s (in: _Destination=0x5c3e508, _SizeInWords=0x57, _Source="*\\CC:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" | out: _Destination="*\\CC:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned 0x0 [0036.827] wcsncpy_s (in: _Destination=0x2a3f80, _SizeInWords=0x108, _Source="*\\Z005e244938", _MaxCount=0x106 | out: _Destination="*\\Z005e244938") returned 0x0 [0036.827] CharLowerBuffW (in: lpsz="*\\Z005e244938", cchLength=0xd | out: lpsz="*\\z005e244938") returned 0xd [0036.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005e244938", cchWideChar=14, lpMultiByteStr=0x2a3ef4, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005e244938", lpUsedDefaultChar=0x0) returned 14 [0036.827] _wcsicmp (_String1="*\\Z005e244938", _String2="*\\Z005e244938") returned 0 [0036.827] wcsncpy_s (in: _Destination=0x2a3f94, _SizeInWords=0x108, _Source="*\\CC:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned 0x0 [0036.827] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", cchLength=0x56 | out: lpsz="*\\cc:\\users\\jpenum\\desktop\\october_invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned 0x56 [0036.827] IMalloc:Alloc (This=0x773f66bc, cb=0xae) returned 0x5c457a0 [0036.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\jpenum\\desktop\\october_invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", cchWideChar=87, lpMultiByteStr=0x5c457a0, cbMultiByte=174, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\jpenum\\desktop\\october_invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde", lpUsedDefaultChar=0x0) returned 87 [0036.827] IMalloc:Free (This=0x773f66bc, pv=0x5c457a0) [0036.827] wcscpy_s (in: _Destination=0x5c47f10, _SizeInWords=0x108, _Source="*\\CC:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" | out: _Destination="*\\CC:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde") returned 0x0 [0036.828] IMalloc:Alloc (This=0x773f66bc, cb=0x4c) returned 0x58aa418 [0036.828] wcscpy_s (in: _Destination=0x58aa454, _SizeInWords=0x7, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0036.828] wcscpy_s (in: _Destination=0x2a3da8, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0036.828] _ltow_s (in: _Value=0, _Buffer=0x2a3db4, _BufferCount=0x3a, _Radix=16 | out: _Buffer="0") returned 0x0 [0036.828] IMalloc:Alloc (This=0x773f66bc, cb=0x414) returned 0x5ac81b8 [0036.828] IMalloc:Alloc (This=0x773f66bc, cb=0xc0) returned 0x5a32e20 [0036.829] IMalloc:Alloc (This=0x773f66bc, cb=0x0) returned 0x5909bf8 [0036.830] IMalloc:Alloc (This=0x773f66bc, cb=0x64) returned 0x5aaf620 [0036.830] IMalloc:Alloc (This=0x773f66bc, cb=0x818) returned 0x5b64fb8 [0036.830] IMalloc:Alloc (This=0x773f66bc, cb=0x218) returned 0x5a372f0 [0036.831] IMalloc:Alloc (This=0x773f66bc, cb=0x1c) returned 0x5717ad8 [0036.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="stephen", cchCount1=7, lpString2="amy", cchCount2=3) returned 3 [0036.832] IMalloc:Alloc (This=0x773f66bc, cb=0x38) returned 0x58b3608 [0036.832] IMalloc:Alloc (This=0x773f66bc, cb=0x30) returned 0x5b49800 [0036.833] IMalloc:Alloc (This=0x773f66bc, cb=0x28) returned 0x5925ef0 [0036.833] IMalloc:Alloc (This=0x773f66bc, cb=0x48) returned 0x59851a0 [0036.835] IMalloc:Free (This=0x773f66bc, pv=0x5ac81b8) [0036.835] IMalloc:Alloc (This=0x773f66bc, cb=0x50) returned 0x58abb78 [0036.835] IMalloc:GetSize (This=0x773f66bc, pv=0x58abb78) returned 0x50 [0036.835] IMalloc:Alloc (This=0x773f66bc, cb=0x70) returned 0x5ae98e0 [0036.835] IMalloc:Alloc (This=0x773f66bc, cb=0x68) returned 0x5aafa10 [0036.835] lstrcpyA (in: lpString1=0x438f140, lpString2="PROJECT" | out: lpString1="PROJECT") returned="PROJECT" [0036.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x438f140, cbMultiByte=-1, lpWideCharStr=0x2a4380, cchWideChar=8 | out: lpWideCharStr="PROJECT") returned 8 [0036.835] lstrlenA (lpString="") returned 0 [0036.836] lstrcpyA (in: lpString1=0x131e1c8, lpString2="" | out: lpString1="") returned="" [0036.836] lstrcpynA (in: lpString1=0x43baf78, lpString2="Host Extender Info", iMaxLength=256 | out: lpString1="Host Extender Info") returned="Host Extender Info" [0036.836] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0036.836] lstrcpyA (in: lpString1=0x43820f0, lpString2="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000" | out: lpString1="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000" [0036.836] lstrcpynA (in: lpString1=0x43bb1a8, lpString2="Workspace", iMaxLength=256 | out: lpString1="Workspace") returned="Workspace" [0036.837] lstrlenA (lpString="25, 25, 1010, 387, ") returned 19 [0036.837] lstrcpyA (in: lpString1=0x131d3b0, lpString2="25, 25, 1010, 387, " | out: lpString1="25, 25, 1010, 387, ") returned="25, 25, 1010, 387, " [0036.837] lstrcpyA (in: lpString1=0x131e1d8, lpString2="" | out: lpString1="") returned="" [0036.838] atoi (_Str="393222000") returned 393222000 [0036.838] lstrcpynA (in: lpString1=0x4381fd8, lpString2="{2C72BD7E-6476-484D-841E-18300AF6D4AE}", iMaxLength=39 | out: lpString1="{2C72BD7E-6476-484D-841E-18300AF6D4AE}") returned="{2C72BD7E-6476-484D-841E-18300AF6D4AE}" [0036.838] StringFromGUID2 (in: rguid=0x6c8eceb8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lpsz=0x5803894, cchMax=39 | out: lpsz="{00000000-0000-0000-0000-000000000000}") returned 39 [0036.838] lstrcmpA (lpString1="{00000000-0000-0000-0000-000000000000}", lpString2="{2C72BD7E-6476-484D-841E-18300AF6D4AE}") returned -1 [0036.839] lstrlenA (lpString="{2C72BD7E-6476-484D-841E-18300AF6D4AE}") returned 38 [0036.851] lstrlenA (lpString="{2C72BD7E-6476-484D-841E-18300AF6D4AE}") returned 38 [0036.851] lstrlenA (lpString="{2C72BD7E-6476-484D-841E-18300AF6D4AE}") returned 38 [0036.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x438f258, cbMultiByte=-1, lpWideCharStr=0x2a4390, cchWideChar=39 | out: lpWideCharStr="{3832D640-CF90-11CF-8E43-00A0C911005A}") returned 39 [0036.854] CLSIDFromString (in: lpsz="{3832D640-CF90-11CF-8E43-00A0C911005A}", pclsid=0x438f2b0 | out: pclsid=0x438f2b0*(Data1=0x3832d640, Data2=0xcf90, Data3=0x11cf, Data4=([0]=0x8e, [1]=0x43, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x5a))) returned 0x0 [0036.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x438f27f, cbMultiByte=-1, lpWideCharStr=0x2a4380, cchWideChar=4 | out: lpWideCharStr="VBE") returned 4 [0036.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5b6503c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0036.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5b6503c, cbMultiByte=-1, lpWideCharStr=0x5717e4c, cchWideChar=10 | out: lpWideCharStr="Database1") returned 10 [0036.855] GetCurrentThreadId () returned 0xe24 [0036.855] GetCurrentThreadId () returned 0xe24 [0036.855] IMalloc:Alloc (This=0x773f66bc, cb=0x1c) returned 0x5718230 [0036.855] GetCursorPos (in: lpPoint=0x2a4520 | out: lpPoint=0x2a4520*(x=562, y=448)) returned 1 [0036.855] GetCapture () returned 0x0 [0036.855] WindowFromPoint (Point=0x232) returned 0x3017a [0036.857] SendMessageA (hWnd=0x3017a, Msg=0x84, wParam=0x0, lParam=0x1c00232) returned 0x1 [0036.857] SendMessageA (hWnd=0x3017a, Msg=0x20, wParam=0x3017a, lParam=0x2000001) returned 0x0 [0036.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93", cchWideChar=-1, lpMultiByteStr=0x438f2e0, cbMultiByte=107, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93", lpUsedDefaultChar=0x0) returned 54 [0036.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5b6503c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0036.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5b6503c, cbMultiByte=-1, lpWideCharStr=0x5717e4c, cchWideChar=10 | out: lpWideCharStr="Database1") returned 10 [0036.858] lstrcatA (in: lpString1="Database1", lpString2=" (" | out: lpString1="Database1 (") returned="Database1 (" [0036.859] strncat_s (in: _Destination="Database1 (", _SizeInBytes=0x187, _Source="October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93", _MaxCount=0x28 | out: _Destination="Database1 (October_Invoiceb91a6edbc0ialmb3ce5ebc15a") returned 0x0 [0036.859] lstrcatA (in: lpString1="Database1 (October_Invoiceb91a6edbc0ialmb3ce5ebc15a", lpString2="...)" | out: lpString1="Database1 (October_Invoiceb91a6edbc0ialmb3ce5ebc15a...)") returned="Database1 (October_Invoiceb91a6edbc0ialmb3ce5ebc15a...)" [0036.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Invoice Data 001", cchWideChar=17, lpMultiByteStr=0x2a4344, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Invoice Data 001", lpUsedDefaultChar=0x0) returned 17 [0036.859] wcscpy_s (in: _Destination=0x2a43e4, _SizeInWords=0x102, _Source="[" | out: _Destination="[") returned 0x0 [0036.906] wcsncpy_s (in: _Destination=0x2a43e6, _SizeInWords=0x101, _Source="Invoice Data 001", _MaxCount=0x10 | out: _Destination="Invoice Data 001") returned 0x0 [0036.906] wcscpy_s (in: _Destination=0x2a4406, _SizeInWords=0xf1, _Source="]" | out: _Destination="]") returned 0x0 [0036.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[Invoice Data 001]", cchWideChar=19, lpMultiByteStr=0x2a4320, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[Invoice Data 001]", lpUsedDefaultChar=0x0) returned 19 [0036.908] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Invoice Data 001") returned 0x10eceb [0036.908] IMalloc:Alloc (This=0x773f66bc, cb=0x4) returned 0x5909f58 [0036.908] qsort (in: _Base=0x5909f58, _NumOfElements=0x1, _SizeOfElements=0x4, _PtFuncCompare=0x6c91a543 | out: _Base=0x5909f58) [0036.908] bsearch (_Key=0x2a3c00, _Base=0x5909f58, _NumOfElements=0x1, _SizeOfElements=0x4, _PtFuncCompare=0x6c91a543) returned 0x5909f58 [0036.908] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Invoice Data 001", cchCount1=-1, lpString2="Invoice Data 001", cchCount2=-1) returned 2 [0036.921] IMalloc:Alloc (This=0x773f66bc, cb=0x194) returned 0x5aa53e8 [0036.921] IMalloc:Alloc (This=0x773f66bc, cb=0x1c) returned 0x5717a38 [0036.921] LoadLibraryA (lpLibFileName="ACEWSTR.DLL") returned 0x6d290000 [0036.922] GetProcAddress (hModule=0x6d290000, lpProcName=0x1) returned 0x6d292c38 [0036.922] GetProcAddress (hModule=0x6d290000, lpProcName=0x3) returned 0x6d291c65 [0036.922] GetProcAddress (hModule=0x6d290000, lpProcName=0x5) returned 0x6d291d73 [0036.923] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180a0 [0036.923] IMalloc:Free (This=0x773f66bc, pv=0x57180a0) [0036.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x131e1c8, cbMultiByte=6, lpWideCharStr=0x2a3a20, cchWideChar=6 | out: lpWideCharStr="apple") returned 6 [0036.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="apple", cchWideChar=6, lpMultiByteStr=0x2a3940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="apple", lpUsedDefaultChar=0x0) returned 6 [0036.924] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="apple") returned 0x10fd1c [0036.924] bsearch (_Key=0x2a3260, _Base=0x5909f58, _NumOfElements=0x1, _SizeOfElements=0x4, _PtFuncCompare=0x6c91a543) returned 0x0 [0036.924] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="apple", cchCount1=-1, lpString2="Invoice Data 001", cchCount2=-1) returned 1 [0036.924] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="apple", cchCount1=-1, lpString2="Database1", cchCount2=-1) returned 1 [0036.924] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="apple", cchCount1=-1, lpString2="VBA", cchCount2=-1) returned 1 [0036.924] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="apple", cchCount1=-1, lpString2="Access", cchCount2=-1) returned 3 [0036.924] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="apple", cchCount1=-1, lpString2="stdole", cchCount2=-1) returned 1 [0036.924] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="apple", cchCount1=-1, lpString2="DAO", cchCount2=-1) returned 1 [0036.924] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="apple", cchCount1=-1, lpString2="apple", cchCount2=-1) returned 2 [0036.925] IMalloc:Free (This=0x773f66bc, pv=0x59851a0) [0036.926] wcscpy_s (in: _Destination=0x2a2da8, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0036.926] _ltow_s (in: _Value=2, _Buffer=0x2a2db4, _BufferCount=0x3a, _Radix=16 | out: _Buffer="2") returned 0x0 [0036.926] IMalloc:Alloc (This=0x773f66bc, cb=0x414) returned 0x5ae7dc8 [0036.926] IMalloc:Alloc (This=0x773f66bc, cb=0x64) returned 0x5aaf380 [0036.926] IMalloc:Alloc (This=0x773f66bc, cb=0x218) returned 0x5a36ea0 [0036.926] IMalloc:Alloc (This=0x773f66bc, cb=0x218) returned 0x5a370c8 [0036.926] IMalloc:Alloc (This=0x773f66bc, cb=0x144) returned 0x5939140 [0036.926] IMalloc:Alloc (This=0x773f66bc, cb=0x30) returned 0x5b491e0 [0036.926] IMalloc:Alloc (This=0x773f66bc, cb=0xb8) returned 0x58e10c8 [0036.927] IMalloc:Alloc (This=0x773f66bc, cb=0xdb4) returned 0x5ac35a8 [0036.927] IMalloc:Alloc (This=0x773f66bc, cb=0x2050) returned 0x1500a58 [0036.927] IMalloc:Alloc (This=0x773f66bc, cb=0x7ec) returned 0x59e56e0 [0036.927] IMalloc:Alloc (This=0x773f66bc, cb=0xcc) returned 0x5c42128 [0036.927] IMalloc:Alloc (This=0x773f66bc, cb=0x40c) returned 0x5a8a768 [0036.927] IMalloc:Alloc (This=0x773f66bc, cb=0xdc) returned 0x563ca28 [0036.927] IMalloc:Alloc (This=0x773f66bc, cb=0xd4) returned 0x5864860 [0036.927] IMalloc:Alloc (This=0x773f66bc, cb=0x14c) returned 0x5939298 [0036.927] IMalloc:Alloc (This=0x773f66bc, cb=0x1f2) returned 0x594d020 [0036.929] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.930] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.930] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.931] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x253) returned 0x6cad16d2 [0036.931] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.931] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.931] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.931] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.931] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x219) returned 0x6c988a48 [0036.931] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.931] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.931] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.932] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.932] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x2cc) returned 0x6caf6ece [0036.932] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.932] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.932] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.932] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.933] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x278) returned 0x6c987f32 [0036.933] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.933] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.933] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.933] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.933] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x204) returned 0x6c9892c0 [0036.933] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.933] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.933] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.934] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.934] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x260) returned 0x6c988aa8 [0036.934] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.934] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.934] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.934] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.935] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x277) returned 0x6c987eed [0036.935] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.935] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.935] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.935] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.936] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x245) returned 0x6c987974 [0036.936] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.936] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.936] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.936] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.936] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x2c9) returned 0x6cb1216f [0036.936] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.936] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.937] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.937] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.937] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x2a9) returned 0x6cad1351 [0036.937] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.937] _stricmp (_Str1="VBE6.DLL", _Str2="VBE6.DLL") returned 0 [0036.937] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x6c8e0000 [0036.937] SetErrorMode (uMode=0x8001) returned 0x8001 [0036.938] GetProcAddress (hModule=0x6c8e0000, lpProcName=0x2cd) returned 0x6cb015d4 [0036.938] IMalloc:Free (This=0x773f66bc, pv=0x5ae7dc8) [0036.938] wcscpy_s (in: _Destination=0x2a3024, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0036.938] _ltow_s (in: _Value=3, _Buffer=0x2a3030, _BufferCount=0x3a, _Radix=16 | out: _Buffer="3") returned 0x0 [0036.938] IMalloc:Alloc (This=0x773f66bc, cb=0x414) returned 0x5ae7dc8 [0036.938] IMalloc:Alloc (This=0x773f66bc, cb=0x64) returned 0x5aaf230 [0036.938] IMalloc:Alloc (This=0x773f66bc, cb=0x218) returned 0x5a356e8 [0036.938] IMalloc:Alloc (This=0x773f66bc, cb=0x30) returned 0x5b49218 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x30) returned 0x5b49170 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x2c) returned 0x5b49100 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x2c) returned 0x5b49090 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x30) returned 0x5b49020 [0036.939] wcscpy_s (in: _Destination=0x2a2efc, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0036.939] _ltow_s (in: _Value=1, _Buffer=0x2a2f08, _BufferCount=0x3a, _Radix=16 | out: _Buffer="1") returned 0x0 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x414) returned 0x5a27318 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x64) returned 0x5aaecf0 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x218) returned 0x5a36600 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x595a330 [0036.939] IMalloc:Free (This=0x773f66bc, pv=0x5a27318) [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x38) returned 0x58b3508 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x30) returned 0x5b48fb0 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x30) returned 0x5b48f40 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x30) returned 0x5b48ed0 [0036.939] IMalloc:Alloc (This=0x773f66bc, cb=0x30) returned 0x5b48e60 [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x34) returned 0x58b27c8 [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x34) returned 0x58b2a48 [0036.940] IMalloc:Free (This=0x773f66bc, pv=0x5ae7dc8) [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x40) returned 0x59a6850 [0036.940] IMalloc:GetSize (This=0x773f66bc, pv=0x59a6850) returned 0x40 [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x595a7c8 [0036.940] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="apple") returned 0x10fd1c [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x595aa50 [0036.940] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Debies") returned 0x10d355 [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x5954d98 [0036.940] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="FvkiSYOsPTHFTSQHvoSnb") returned 0x10482a [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x5954f30 [0036.940] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="SliLTuQPD") returned 0x102ba2 [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x59559c8 [0036.940] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="hrSdhMuBcpCZwgOxRBC") returned 0x104234 [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x59559f8 [0036.940] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Hex2Str") returned 0x107eea [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x59563b8 [0036.940] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="DecryptEPI") returned 0x10e2e0 [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x5956538 [0036.940] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Oct2Dec") returned 0x106e0b [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x59564f0 [0036.940] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="XOREncryption") returned 0x108e67 [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x10) returned 0x59599e8 [0036.940] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="RC4String") returned 0x105a2b [0036.940] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="apple", cchCount1=-1, lpString2="apple", cchCount2=-1) returned 2 [0036.940] IMalloc:Alloc (This=0x773f66bc, cb=0x34) returned 0x58b2988 [0036.940] IMalloc:GetSize (This=0x773f66bc, pv=0x58b2988) returned 0x34 [0036.945] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180a0 [0036.945] IMalloc:Free (This=0x773f66bc, pv=0x57180a0) [0036.945] IMalloc:Alloc (This=0x773f66bc, cb=0xc) returned 0x5959310 [0036.945] IMalloc:Free (This=0x773f66bc, pv=0x58b2988) [0036.945] GetModuleFileNameW (in: hModule=0x6c8e0000, lpFilename=0x6cb1cbb8, nSize=0x104 | out: lpFilename="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\progra~1\\common~1\\micros~1\\vba\\vba7.1\\vbe7.dll")) returned 0x31 [0036.945] QueryPathOfRegTypeLib (in: guid=0x6c910fb0*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), wMaj=0x4, wMin=0x0, lcid=0x409, lpbstrPathName=0x2a3c38 | out: lpbstrPathName=0x2a3c38) returned 0x0 [0036.947] LoadTypeLibEx (in: szFile="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL", regkind=0x2, pptlib=0x2a3ca4*=0x59fd118 | out: pptlib=0x2a3ca4*=0x5a36a50) returned 0x0 [0036.952] IUnknown:AddRef (This=0x5a36a50) returned 0x2 [0036.952] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.952] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.952] IUnknown:Release (This=0x5a36a50) returned 0x4 [0036.952] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.952] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.952] IUnknown:Release (This=0x5a36a50) returned 0x4 [0036.953] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.953] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.953] IUnknown:Release (This=0x5a36a50) returned 0x4 [0036.953] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.953] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.953] IUnknown:Release (This=0x5a36a50) returned 0x4 [0036.953] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.953] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.953] IUnknown:Release (This=0x5a36a50) returned 0x5 [0036.953] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.953] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.953] IUnknown:Release (This=0x5a36a50) returned 0x5 [0036.954] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.954] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.954] IUnknown:Release (This=0x5a36a50) returned 0x5 [0036.954] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.954] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.954] IUnknown:Release (This=0x5a36a50) returned 0x5 [0036.954] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.954] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.954] IUnknown:Release (This=0x5a36a50) returned 0x5 [0036.954] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.954] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.954] IUnknown:Release (This=0x5a36a50) returned 0x5 [0036.954] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.954] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.954] IUnknown:Release (This=0x5a36a50) returned 0x5 [0036.954] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.954] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.954] IUnknown:Release (This=0x5a36a50) returned 0x5 [0036.954] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.954] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.954] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.956] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.956] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.957] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.957] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.957] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.957] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.957] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.957] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.957] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.957] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.957] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.957] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.957] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.957] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.957] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.957] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.957] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.957] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.957] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.957] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.957] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.957] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.957] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.958] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.958] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.958] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.958] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.958] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.958] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.958] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.958] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.958] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.958] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.958] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.958] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.958] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.958] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.958] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.958] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.958] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.958] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.958] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.958] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.958] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.958] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.958] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.959] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.959] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.959] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.959] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.959] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.959] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.959] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.959] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.959] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.959] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.959] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.959] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.959] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.959] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.959] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.959] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.959] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.959] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.959] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.959] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.959] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.959] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.959] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.960] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.960] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.960] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.960] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.960] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.960] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.960] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.960] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.960] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.960] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.960] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.960] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.960] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.960] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.960] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.960] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.960] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.960] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.960] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.960] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.960] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.960] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.961] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.961] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.961] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.961] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.961] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.961] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.961] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.961] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.961] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.961] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.961] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.961] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.961] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.961] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.961] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.961] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.961] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.961] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.961] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.961] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.961] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.961] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.961] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.962] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.962] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.962] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.962] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.962] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.962] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.962] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.962] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.962] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.962] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.962] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.962] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.962] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.962] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.962] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.962] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.962] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.962] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.962] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.962] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.962] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.962] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.963] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.963] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.963] IUnknown:Release (This=0x5a36a50) returned 0x6 [0036.963] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.963] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.963] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.963] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.963] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.963] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.963] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.963] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.963] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.963] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.963] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.963] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.963] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.963] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.963] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.963] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.963] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.963] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.963] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.964] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.964] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.964] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.964] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.964] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.964] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.964] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.964] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.964] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.964] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.964] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.964] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.964] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.964] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.964] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.964] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.964] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.964] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.964] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.964] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.964] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.964] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.965] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.965] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.965] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.965] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.965] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.965] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.965] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.965] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.965] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.965] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.965] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.965] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.965] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.965] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.965] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.965] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.965] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.965] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.965] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.965] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.965] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.965] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.966] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.966] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.966] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.966] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.966] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.966] IUnknown:Release (This=0x5a36a50) returned 0x7 [0036.966] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.966] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.966] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.966] IMalloc:Free (This=0x773f66bc, pv=0x57180c8) [0036.966] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.966] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.966] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.966] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.966] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.966] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.967] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.967] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.967] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.967] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.967] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.967] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.967] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.967] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.967] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.967] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.967] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.967] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.967] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.967] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.967] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.967] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.967] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.967] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.967] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.967] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.967] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.968] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.968] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.968] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.968] ITypeLib:RemoteGetLibAttr (in: This=0x5a36a50, ppTLibAttr=0x2a3c34, pDummy=0x58b3718 | out: ppTLibAttr=0x2a3c34, pDummy=0x58b3718*=0x3dd1dc) returned 0x0 [0036.968] ITypeLib:LocalReleaseTLibAttr (This=0x5a36a50) returned 0x5717e48 [0036.968] IUnknown:Release (This=0x5a36a50) returned 0x8 [0036.971] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0036.972] IMalloc:Alloc (This=0x773f66bc, cb=0x20) returned 0x57180c8 [0036.972] DispCallFunc (pvInstance=0x0, oVft=0x5a36ef2, cc=0x4, vtReturn=0xc, cActuals=0x0, prgvt=0x0, prgpvarg=0x0, pvargResult=0x2a3d0c) [0036.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1000, lpStartAddress=0x6c8e36d3, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x2a314c | out: lpThreadId=0x2a314c*=0xecc) returned 0x65c [0036.974] PeekMessageA (in: lpMsg=0x2a312c, hWnd=0x2026e, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x2a312c) returned 0 [0036.981] GetActiveWindow () returned 0x301c6 [0036.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x5717e4c, cchWideChar=1 | out: lpWideCharStr="\x1b") returned 1 [0036.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x5717ab4, cchWideChar=1 | out: lpWideCharStr="P") returned 1 [0036.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x5717e24, cchWideChar=1 | out: lpWideCharStr="\x11") returned 1 [0036.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x59167b4, cchWideChar=1 | out: lpWideCharStr="!") returned 1 [0036.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x59155e4, cchWideChar=1 | out: lpWideCharStr="\x16") returned 1 [0036.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595a2bc, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0036.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x59599a4, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0036.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595a34c, cchWideChar=1 | out: lpWideCharStr=";") returned 1 [0036.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x5959ecc, cchWideChar=1 | out: lpWideCharStr="\x14") returned 1 [0036.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x5959614, cchWideChar=1 | out: lpWideCharStr="\x0e") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x5956824, cchWideChar=1 | out: lpWideCharStr="\x19") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x59567f4, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x5956d1c, cchWideChar=1 | out: lpWideCharStr="\x11") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595aa3c, cchWideChar=1 | out: lpWideCharStr="$") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x5956704, cchWideChar=1 | out: lpWideCharStr="k") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595680c, cchWideChar=1 | out: lpWideCharStr="O") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595aa24, cchWideChar=1 | out: lpWideCharStr="\x12") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595704c, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595aa0c, cchWideChar=1 | out: lpWideCharStr="\x14") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595b9b4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595b414, cchWideChar=1 | out: lpWideCharStr="\x18") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x59581ec, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x59568e4, cchWideChar=1 | out: lpWideCharStr="\x11") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595a8ec, cchWideChar=1 | out: lpWideCharStr="^") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595af7c, cchWideChar=1 | out: lpWideCharStr="\x17") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595a934, cchWideChar=1 | out: lpWideCharStr="M") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x5953e84, cchWideChar=1 | out: lpWideCharStr="\xde") returned 1 [0036.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595a9dc, cchWideChar=1 | out: lpWideCharStr=">") returned 1 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595aea4, cchWideChar=1 | out: lpWideCharStr="\\") returned 1 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x5959e6c, cchWideChar=1 | out: lpWideCharStr="|") returned 1 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595aa9c, cchWideChar=1 | out: lpWideCharStr="j") returned 1 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595a244, cchWideChar=1 | out: lpWideCharStr="\x0f") returned 1 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595b15c, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595ab74, cchWideChar=1 | out: lpWideCharStr="{") returned 1 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595a364, cchWideChar=1 | out: lpWideCharStr="T") returned 1 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595a274, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e44, cbMultiByte=1, lpWideCharStr=0x595a424, cchWideChar=1 | out: lpWideCharStr="O") returned 1 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e40, cbMultiByte=1, lpWideCharStr=0x595b1bc, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0036.984] VarBstrCat (in: bstrLeft="O", bstrRight="a", pbstrResult=0x2a2e34 | out: pbstrResult=0x2a2e34) returned 0x0 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e40, cbMultiByte=1, lpWideCharStr=0x595b18c, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0036.984] VarBstrCat (in: bstrLeft="Oa", bstrRight="g", pbstrResult=0x2a2e34 | out: pbstrResult=0x2a2e34) returned 0x0 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e40, cbMultiByte=1, lpWideCharStr=0x595a37c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0036.984] VarBstrCat (in: bstrLeft="Oag", bstrRight="1", pbstrResult=0x2a2e34 | out: pbstrResult=0x2a2e34) returned 0x0 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e40, cbMultiByte=1, lpWideCharStr=0x595a394, cchWideChar=1 | out: lpWideCharStr="N") returned 1 [0036.984] VarBstrCat (in: bstrLeft="Oag1", bstrRight="N", pbstrResult=0x2a2e34 | out: pbstrResult=0x2a2e34) returned 0x0 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e40, cbMultiByte=1, lpWideCharStr=0x595a43c, cchWideChar=1 | out: lpWideCharStr="Q") returned 1 [0036.984] VarBstrCat (in: bstrLeft="Oag1N", bstrRight="Q", pbstrResult=0x2a2e34 | out: pbstrResult=0x2a2e34) returned 0x0 [0036.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e40, cbMultiByte=1, lpWideCharStr=0x595b0fc, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0036.985] VarBstrCat (in: bstrLeft="Oag1NQ", bstrRight="f", pbstrResult=0x2a2e34 | out: pbstrResult=0x2a2e34) returned 0x0 [0036.985] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2e40, cbMultiByte=1, lpWideCharStr=0x595a3ac, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0036.985] VarBstrCat (in: bstrLeft="Oag1NQf", bstrRight="n", pbstrResult=0x2a2e34 | out: pbstrResult=0x2a2e34) returned 0x0 [0036.986] VarBstrCat (in: bstrLeft="\xde", bstrRight=">", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.986] VarBstrCat (in: bstrLeft="\xde\x3e", bstrRight="\\", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.986] VarBstrCat (in: bstrLeft="\xde\x3e\x5c", bstrRight="|", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.986] VarBstrCat (in: bstrLeft="\xde\x3e\x5c\x7c", bstrRight="j", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.986] VarBstrCat (in: bstrLeft="\xde\x3e\x5c\x7c\x6a", bstrRight="\x0f", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.986] VarBstrCat (in: bstrLeft="\xde\x3e\x5c\x7c\x6a\x0f", bstrRight="S", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.986] VarBstrCat (in: bstrLeft="\xde\x3e\x5c\x7c\x6a\x0f\x53", bstrRight="{", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.986] VarBstrCat (in: bstrLeft="\xde\x3e\x5c\x7c\x6a\x0f\x53\x7b", bstrRight="T", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.986] VarBstrCat (in: bstrLeft="\xde\x3e\x5c\x7c\x6a\x0f\x53\x7b\x54", bstrRight="d", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.987] SafeArrayAllocData (psa=0x2a2d8c) returned 0x0 [0036.989] GetUserDefaultLCID () returned 0x409 [0036.989] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x2a2d20, cchData=6 | out: lpLCData="1252") returned 5 [0036.989] atoi (_Str="1252") returned 1252 [0036.989] SysStringLen (param_1="Oag1NQfn") returned 0x8 [0036.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oag1NQfn", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.989] SysStringLen (param_1="Oag1NQfn") returned 0x8 [0036.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oag1NQfn", cchWideChar=9, lpMultiByteStr=0x595a4cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Oag1NQfn", lpUsedDefaultChar=0x0) returned 9 [0036.990] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x2a2d1c | out: ppsaOut=0x2a2d1c) returned 0x0 [0036.990] SafeArrayAllocData (psa=0x5925e70) returned 0x0 [0036.991] GetUserDefaultLCID () returned 0x409 [0036.991] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x2a2d20, cchData=6 | out: lpLCData="1252") returned 5 [0036.991] atoi (_Str="1252") returned 1252 [0036.991] SysStringLen (param_1="\xde\x3e\x5c\x7c\x6a\x0f\x53\x7b\x54\x64") returned 0xa [0036.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\xde\x3e\x5c\x7c\x6a\x0f\x53\x7b\x54\x64", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.991] SysStringLen (param_1="\xde\x3e\x5c\x7c\x6a\x0f\x53\x7b\x54\x64") returned 0xa [0036.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\xde\x3e\x5c\x7c\x6a\x0f\x53\x7b\x54\x64", cchWideChar=11, lpMultiByteStr=0x595a4cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\xde\x3e\x5c\x7c\x6a\x0f\x53\x7b\x54\x64", lpUsedDefaultChar=0x0) returned 11 [0036.991] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x2a2d1c | out: ppsaOut=0x2a2d1c) returned 0x0 [0036.991] SafeArrayAllocData (psa=0x5925db0) returned 0x0 [0036.992] SafeArrayDestroyData (psa=0x5925e70) returned 0x0 [0036.992] SafeArrayDestroyDescriptor (psa=0x5925e70) returned 0x0 [0036.992] VarAdd (in: pvarLeft=0x2a2d40, pvarRight=0x2a2d6c, pvarResult=0x2a2d5c | out: pvarResult=0x2a2d5c) returned 0x0 [0036.992] VarAdd (in: pvarLeft=0x2a2d40, pvarRight=0x2a2d6c, pvarResult=0x2a2d5c | out: pvarResult=0x2a2d5c) returned 0x0 [0036.992] VarAdd (in: pvarLeft=0x2a2d40, pvarRight=0x2a2d6c, pvarResult=0x2a2d5c | out: pvarResult=0x2a2d5c) returned 0x0 [0036.992] VarAdd (in: pvarLeft=0x2a2d40, pvarRight=0x2a2d6c, pvarResult=0x2a2d5c | out: pvarResult=0x2a2d5c) returned 0x0 [0036.992] VarAdd (in: pvarLeft=0x2a2d40, pvarRight=0x2a2d6c, pvarResult=0x2a2d5c | out: pvarResult=0x2a2d5c) returned 0x0 [0036.992] VarAdd (in: pvarLeft=0x2a2d40, pvarRight=0x2a2d6c, pvarResult=0x2a2d5c | out: pvarResult=0x2a2d5c) returned 0x0 [0036.992] VarAdd (in: pvarLeft=0x2a2d40, pvarRight=0x2a2d6c, pvarResult=0x2a2d5c | out: pvarResult=0x2a2d5c) returned 0x0 [0036.992] VarAdd (in: pvarLeft=0x2a2d40, pvarRight=0x2a2d6c, pvarResult=0x2a2d5c | out: pvarResult=0x2a2d5c) returned 0x0 [0036.992] VarAdd (in: pvarLeft=0x2a2d40, pvarRight=0x2a2d6c, pvarResult=0x2a2d5c | out: pvarResult=0x2a2d5c) returned 0x0 [0036.992] VarAdd (in: pvarLeft=0x2a2d40, pvarRight=0x2a2d6c, pvarResult=0x2a2d5c | out: pvarResult=0x2a2d5c) returned 0x0 [0036.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5b6503c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0036.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5b6503c, cbMultiByte=-1, lpWideCharStr=0x5718004, cchWideChar=10 | out: lpWideCharStr="Database1") returned 10 [0036.993] GetUserDefaultLCID () returned 0x409 [0036.993] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x2a2d20, cchData=6 | out: lpLCData="1252") returned 5 [0036.994] atoi (_Str="1252") returned 1252 [0036.995] SysStringByteLen (bstr="㙚扒煔祓晖") returned 0xa [0036.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x595a4cc, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0036.995] SysStringByteLen (bstr="㙚扒煔祓晖") returned 0xa [0036.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x595a4cc, cbMultiByte=11, lpWideCharStr=0x571811c, cchWideChar=11 | out: lpWideCharStr="Z6RbTqSyVf") returned 11 [0036.995] SafeArrayDestroyData (psa=0x5925db0) returned 0x0 [0036.996] SafeArrayDestroyDescriptor (psa=0x5925db0) returned 0x0 [0036.996] SafeArrayDestroyData (psa=0x2a2d8c) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1b", bstrRight="P", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP", bstrRight="\x11", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11", bstrRight="!", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!", bstrRight="\x16", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!\x16", bstrRight="2", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162", bstrRight="\x10", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10", bstrRight=";", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;", bstrRight="\x14", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14", bstrRight="\x0e", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e", bstrRight="\x19", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19", bstrRight="v", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v", bstrRight="\x11", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11", bstrRight="$", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.996] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$", bstrRight="k", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$k", bstrRight="O", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$kO", bstrRight="\x12", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$kO\x12", bstrRight=":", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$kO\x12:", bstrRight="\x14", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$kO\x12:\x14", bstrRight="\x01", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$kO\x12:\x14\x01", bstrRight="\x18", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$kO\x12:\x14\x01\x18", bstrRight="q", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$kO\x12:\x14\x01\x18q", bstrRight="\x11", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$kO\x12:\x14\x01\x18q\x11", bstrRight="^", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$kO\x12:\x14\x01\x18q\x11^", bstrRight="\x17", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.997] VarBstrCat (in: bstrLeft="\x1bP\x11!\x162\x10;\x14\x0e\x19v\x11$kO\x12:\x14\x01\x18q\x11^\x17", bstrRight="M", pbstrResult=0x2a2e30 | out: pbstrResult=0x2a2e30) returned 0x0 [0036.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Z", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x5a\xb1\x95\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x1b", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x1b\xab\x95\x05\x5a", lpUsedDefaultChar=0x0) returned 1 [0037.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x595a4b4, cchWideChar=1 | out: lpWideCharStr="A") returned 1 [0037.000] VarBstrCat (in: bstrLeft=0x0, bstrRight="A", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x36\xb1\x95\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x50\xab\x95\x05\x36", lpUsedDefaultChar=0x0) returned 1 [0037.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x595a4b4, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0037.000] VarBstrCat (in: bstrLeft="A", bstrRight="f", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="R", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x52\xa4\x95\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x11", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x11\xb1\x95\x05\x52", lpUsedDefaultChar=0x0) returned 1 [0037.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x595abec, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0037.000] VarBstrCat (in: bstrLeft="Af", bstrRight="C", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x62\xa4\x95\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x21\xa4\x95\x05\x62", lpUsedDefaultChar=0x0) returned 1 [0037.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x595b1ec, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0037.000] VarBstrCat (in: bstrLeft="AfC", bstrRight="C", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x54\xa4\x95\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x16", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x16\xa4\x95\x05\x54", lpUsedDefaultChar=0x0) returned 1 [0037.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x595a40c, cchWideChar=1 | out: lpWideCharStr="B") returned 1 [0037.001] VarBstrCat (in: bstrLeft="AfCC", bstrRight="B", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x71\xab\x95\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x32\xa4\x95\x05\x71", lpUsedDefaultChar=0x0) returned 1 [0037.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x595a454, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0037.001] VarBstrCat (in: bstrLeft="AfCCB", bstrRight="C", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x53\xb1\x95\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10\xab\x95\x05\x53", lpUsedDefaultChar=0x0) returned 1 [0037.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x595a4b4, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0037.001] VarBstrCat (in: bstrLeft="AfCCBC", bstrRight="C", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x79\x83\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=";", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3b\xb1\x95\x05\x79", lpUsedDefaultChar=0x0) returned 1 [0037.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x595abec, cchWideChar=1 | out: lpWideCharStr="B") returned 1 [0037.002] VarBstrCat (in: bstrLeft="AfCCBCC", bstrRight="B", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x56\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x14", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x14\x83\x71\x05\x56", lpUsedDefaultChar=0x0) returned 1 [0037.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x595b1ec, cchWideChar=1 | out: lpWideCharStr="B") returned 1 [0037.002] VarBstrCat (in: bstrLeft="AfCCBCCB", bstrRight="B", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x66\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0e\x82\x71\x05\x66", lpUsedDefaultChar=0x0) returned 1 [0037.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0037.002] VarBstrCat (in: bstrLeft="AfCCBCCBB", bstrRight="h", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Z", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x5a\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x19", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x19\x82\x71\x05\x5a", lpUsedDefaultChar=0x0) returned 1 [0037.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x57182fc, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0037.002] VarBstrCat (in: bstrLeft="AfCCBCCBBh", bstrRight="C", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x36\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x76\x82\x71\x05\x36", lpUsedDefaultChar=0x0) returned 1 [0037.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718284, cchWideChar=1 | out: lpWideCharStr="@") returned 1 [0037.003] VarBstrCat (in: bstrLeft="AfCCBCCBBhC", bstrRight="@", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="R", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x52\x83\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x11", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x11\x82\x71\x05\x52", lpUsedDefaultChar=0x0) returned 1 [0037.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x571825c, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0037.003] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@", bstrRight="C", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x62\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x24\x83\x71\x05\x62", lpUsedDefaultChar=0x0) returned 1 [0037.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x571820c, cchWideChar=1 | out: lpWideCharStr="F") returned 1 [0037.003] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@C", bstrRight="F", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x54\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x6b\x82\x71\x05\x54", lpUsedDefaultChar=0x0) returned 1 [0037.004] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="?") returned 1 [0037.004] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF", bstrRight="?", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x71\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x4f\x82\x71\x05\x71", lpUsedDefaultChar=0x0) returned 1 [0037.004] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr=">") returned 1 [0037.004] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?", bstrRight=">", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x53\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x12", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x12\x82\x71\x05\x53", lpUsedDefaultChar=0x0) returned 1 [0037.004] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="A") returned 1 [0037.004] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?>", bstrRight="A", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x79\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=":", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3a\x82\x71\x05\x79", lpUsedDefaultChar=0x0) returned 1 [0037.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0037.005] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?>A", bstrRight="C", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x56\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x14", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x14\x82\x71\x05\x56", lpUsedDefaultChar=0x0) returned 1 [0037.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="B") returned 1 [0037.005] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?>AC", bstrRight="B", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x66\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x82\x71\x05\x66", lpUsedDefaultChar=0x0) returned 1 [0037.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0037.005] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?>ACB", bstrRight="g", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Z", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x5a\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x18", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x18\x82\x71\x05\x5a", lpUsedDefaultChar=0x0) returned 1 [0037.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="B") returned 1 [0037.005] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?>ACBg", bstrRight="B", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x36\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x71\x82\x71\x05\x36", lpUsedDefaultChar=0x0) returned 1 [0037.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="G") returned 1 [0037.005] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?>ACBgB", bstrRight="G", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="R", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x52\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x11", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x11\x82\x71\x05\x52", lpUsedDefaultChar=0x0) returned 1 [0037.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0037.006] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?>ACBgBG", bstrRight="C", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x62\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="^", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x5e\x82\x71\x05\x62", lpUsedDefaultChar=0x0) returned 1 [0037.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="<") returned 1 [0037.006] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?>ACBgBGC", bstrRight="<", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x54\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x17", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x17\x82\x71\x05\x54", lpUsedDefaultChar=0x0) returned 1 [0037.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0037.006] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?>ACBgBGC<", bstrRight="C", pbstrResult=0x2a2c44 | out: pbstrResult=0x2a2c44) returned 0x0 [0037.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x2a2c78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x71\x82\x71\x05\x90\x2c\x2a", lpUsedDefaultChar=0x0) returned 1 [0037.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x2a2c74, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x4d\x82\x71\x05\x71", lpUsedDefaultChar=0x0) returned 1 [0037.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a2c6c, cbMultiByte=1, lpWideCharStr=0x5718374, cchWideChar=1 | out: lpWideCharStr="<") returned 1 [0037.006] VarBstrCat (in: bstrLeft="AfCCBCCBBhC@CF?>ACBgBGC?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ稍뷃቟水Ā") returned 256 [0080.988] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ稍뷃቟水Ā", cchSrc=256, lpCharType=0x32f160 | out: lpCharType=0x32f160) returned 1 [0080.988] GetLastError () returned 0x0 [0080.988] SetLastError (dwErrCode=0x0) [0080.988] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0080.988] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x32f560, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.988] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x32f560, cbMultiByte=256, lpWideCharStr=0x32ee98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿຣ水Ā") returned 256 [0080.988] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿຣ水Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0080.988] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿຣ水Ā", cchSrc=256, lpDestStr=0x32ec88, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x32f460, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x55", lpUsedDefaultChar=0x0) returned 256 [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.989] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x32f560, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.989] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x32f560, cbMultiByte=256, lpWideCharStr=0x32eeb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿຣ水Ā") returned 256 [0080.989] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿຣ水Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0080.989] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿຣ水Ā", cchSrc=256, lpDestStr=0x32eca8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0080.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x32f360, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x55", lpUsedDefaultChar=0x0) returned 256 [0080.989] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6c3503a0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MsiExec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe")) returned 0x1f [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.989] GetLastError () returned 0x0 [0080.989] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.990] SetLastError (dwErrCode=0x0) [0080.990] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.991] SetLastError (dwErrCode=0x0) [0080.991] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.992] SetLastError (dwErrCode=0x0) [0080.992] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.993] GetLastError () returned 0x0 [0080.993] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.994] SetLastError (dwErrCode=0x0) [0080.994] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.995] SetLastError (dwErrCode=0x0) [0080.995] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.996] SetLastError (dwErrCode=0x0) [0080.996] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.997] SetLastError (dwErrCode=0x0) [0080.997] GetLastError () returned 0x0 [0080.998] SetLastError (dwErrCode=0x0) [0080.998] GetLastError () returned 0x0 [0080.998] SetLastError (dwErrCode=0x0) [0080.998] GetLastError () returned 0x0 [0080.998] SetLastError (dwErrCode=0x0) [0080.998] GetLastError () returned 0x0 [0080.998] SetLastError (dwErrCode=0x0) [0080.998] GetLastError () returned 0x0 [0080.998] SetLastError (dwErrCode=0x0) [0080.998] GetLastError () returned 0x0 [0080.998] SetLastError (dwErrCode=0x0) [0080.998] GetLastError () returned 0x0 [0080.998] SetLastError (dwErrCode=0x0) [0080.998] GetLastError () returned 0x0 [0080.998] SetLastError (dwErrCode=0x0) [0080.998] GetLastError () returned 0x0 [0080.998] SetLastError (dwErrCode=0x0) [0081.002] MsiCreateRecord (cParams=0x2) returned 0x2 [0081.005] MsiRecordSetStringW (hRecord=0x2, iField=0x0, szValue="-- CUSTOM ACTION -- InstallMain") returned 0x0 [0081.006] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2) returned 0 [0081.008] MsiCloseHandle (hAny=0x2) returned 0x0 [0081.008] GetCurrentProcess () returned 0xffffffff [0081.008] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x32fa18 | out: TokenHandle=0x32fa18*=0x150) returned 1 [0081.008] GetTokenInformation (in: TokenHandle=0x150, TokenInformationClass=0x14, TokenInformation=0x32fa10, TokenInformationLength=0x4, ReturnLength=0x32fa14 | out: TokenInformation=0x32fa10, ReturnLength=0x32fa14) returned 1 [0081.008] CloseHandle (hObject=0x150) returned 1 [0081.009] MsiCreateRecord (cParams=0x2) returned 0x3 [0081.009] MsiRecordSetStringW (hRecord=0x3, iField=0x0, szValue="-- CUSTOM ACTION -- Not elevated") returned 0x0 [0081.010] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3) returned 0 [0081.011] MsiCloseHandle (hAny=0x3) returned 0x0 [0081.012] GetUserNameW (in: lpBuffer=0x32ea78, pcbBuffer=0x32ea74 | out: lpBuffer="JPenUM", pcbBuffer=0x32ea74) returned 1 [0081.014] MsiCreateRecord (cParams=0x2) returned 0x4 [0081.015] MsiRecordSetStringW (hRecord=0x4, iField=0x0, szValue="-- CUSTOM ACTION -- User name is JPenUM") returned 0x0 [0081.016] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x4) returned 0 [0081.017] MsiCloseHandle (hAny=0x4) returned 0x0 [0081.018] IsUserAnAdmin () returned 0 [0081.018] MsiCreateRecord (cParams=0x2) returned 0x5 [0081.019] MsiRecordSetStringW (hRecord=0x5, iField=0x0, szValue="-- CUSTOM ACTION -- The user is not a member of the Administrators group.") returned 0x0 [0081.019] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x5) returned 0 [0081.021] MsiCloseHandle (hAny=0x5) returned 0x0 [0081.022] UuidCreate (in: Uuid=0x32f990 | out: Uuid=0x32f990) returned 0x0 [0081.022] UuidToStringW (in: Uuid=0x32f990, StringUuid=0x32f98c | out: StringUuid=0x32f98c) returned 0x0 [0081.022] RpcStringFreeW (in: String=0x32f98c | out: String=0x32f98c) returned 0x0 [0081.022] GetTempPathW (in: nBufferLength=0x105, lpBuffer=0x32f794 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\") returned 0x23 [0081.022] CreateDirectoryW (lpPathName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377"), lpSecurityAttributes=0x0) returned 1 [0081.023] CreateDirectoryW (lpPathName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files"), lpSecurityAttributes=0x0) returned 1 [0081.023] MsiCreateRecord (cParams=0x2) returned 0x6 [0081.024] MsiRecordSetStringW (hRecord=0x6, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.WRAPPED_APPID") returned 0x0 [0081.025] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x6) returned 0 [0081.026] MsiCloseHandle (hAny=0x6) returned 0x0 [0081.027] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.WRAPPED_APPID", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0081.028] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.WRAPPED_APPID", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}", pcchValueBuf=0x32f99c) returned 0x0 [0081.029] MsiCreateRecord (cParams=0x2) returned 0x7 [0081.030] MsiRecordSetStringW (hRecord=0x7, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value={F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}") returned 0x0 [0081.031] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x7) returned 0 [0081.032] MsiCloseHandle (hAny=0x7) returned 0x0 [0081.033] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="WrappedApplicationId", lpString="{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0081.036] MsiCreateRecord (cParams=0x2) returned 0x8 [0081.037] MsiRecordSetStringW (hRecord=0x8, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.INSTALL_SUCCESS_CODES") returned 0x0 [0081.038] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x8) returned 0 [0081.039] MsiCloseHandle (hAny=0x8) returned 0x0 [0081.040] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.INSTALL_SUCCESS_CODES", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0081.041] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.INSTALL_SUCCESS_CODES", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="0", pcchValueBuf=0x32f99c) returned 0x0 [0081.041] MsiCreateRecord (cParams=0x2) returned 0x9 [0081.042] MsiRecordSetStringW (hRecord=0x9, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=0") returned 0x0 [0081.042] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x9) returned 0 [0081.044] MsiCloseHandle (hAny=0x9) returned 0x0 [0081.044] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="InstallSuccessCodes", lpString="0", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0081.046] MsiCreateRecord (cParams=0x2) returned 0xa [0081.047] MsiRecordSetStringW (hRecord=0xa, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.ELEVATE_EXECUTABLE") returned 0x0 [0081.047] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xa) returned 0 [0081.049] MsiCloseHandle (hAny=0xa) returned 0x0 [0081.049] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.ELEVATE_EXECUTABLE", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0081.050] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.ELEVATE_EXECUTABLE", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="administrators", pcchValueBuf=0x32f99c) returned 0x0 [0081.050] MsiCreateRecord (cParams=0x2) returned 0xb [0081.051] MsiRecordSetStringW (hRecord=0xb, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=administrators") returned 0x0 [0081.052] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xb) returned 0 [0081.053] MsiCloseHandle (hAny=0xb) returned 0x0 [0081.053] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="ElevateExecutable", lpString="administrators", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0081.055] MsiCreateRecord (cParams=0x2) returned 0xc [0081.056] MsiRecordSetStringW (hRecord=0xc, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.BASENAME") returned 0x0 [0081.056] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xc) returned 0 [0081.057] MsiCloseHandle (hAny=0xc) returned 0x0 [0081.058] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.BASENAME", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0081.059] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.BASENAME", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="MsMpEng.exe", pcchValueBuf=0x32f99c) returned 0x0 [0081.059] MsiCreateRecord (cParams=0x2) returned 0xd [0081.060] MsiRecordSetStringW (hRecord=0xd, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=MsMpEng.exe") returned 0x0 [0081.061] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xd) returned 0 [0081.062] MsiCloseHandle (hAny=0xd) returned 0x0 [0081.062] MsiCreateRecord (cParams=0x2) returned 0xe [0081.063] MsiRecordSetStringW (hRecord=0xe, iField=0x0, szValue="-- CUSTOM ACTION -- Save wrapped installer cabinet") returned 0x0 [0081.064] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xe) returned 0 [0081.065] MsiCloseHandle (hAny=0xe) returned 0x0 [0081.065] MsiCreateRecord (cParams=0x2) returned 0xf [0081.066] MsiRecordSetStringW (hRecord=0xf, iField=0x0, szValue="-- CUSTOM ACTION -- Get database") returned 0x0 [0081.067] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xf) returned 0 [0081.068] MsiCloseHandle (hAny=0xf) returned 0x0 [0081.069] MsiGetActiveDatabase (hInstall=0x1) returned 0x10 [0081.069] MsiCreateRecord (cParams=0x2) returned 0x11 [0081.070] MsiRecordSetStringW (hRecord=0x11, iField=0x0, szValue="-- CUSTOM ACTION -- Open view") returned 0x0 [0081.070] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x11) returned 0 [0081.071] MsiCloseHandle (hAny=0x11) returned 0x0 [0081.072] GetLastError () returned 0x0 [0081.072] SetLastError (dwErrCode=0x0) [0081.072] GetLastError () returned 0x0 [0081.072] SetLastError (dwErrCode=0x0) [0081.072] MsiCreateRecord (cParams=0x2) returned 0x12 [0081.073] MsiRecordSetStringW (hRecord=0x12, iField=0x0, szValue="-- CUSTOM ACTION -- Query: SELECT `Data` FROM `Binary` WHERE `Name` = 'bz.WrappedSetupProgram'") returned 0x0 [0081.074] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x12) returned 0 [0081.075] MsiCloseHandle (hAny=0x12) returned 0x0 [0081.075] MsiDatabaseOpenViewW (hDatabase=0x10, szQuery="SELECT `Data` FROM `Binary` WHERE `Name` = 'bz.WrappedSetupProgram'", phView=0x32f534) returned 0x0 [0081.078] MsiCreateRecord (cParams=0x2) returned 0x14 [0081.079] MsiRecordSetStringW (hRecord=0x14, iField=0x0, szValue="-- CUSTOM ACTION -- Execute view") returned 0x0 [0081.080] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x14) returned 0 [0081.081] MsiCloseHandle (hAny=0x14) returned 0x0 [0081.081] MsiViewExecute (hView=0x13, hRecord=0x0) returned 0x0 [0081.082] MsiCreateRecord (cParams=0x2) returned 0x15 [0081.083] MsiRecordSetStringW (hRecord=0x15, iField=0x0, szValue="-- CUSTOM ACTION -- Get record") returned 0x0 [0081.083] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x15) returned 0 [0081.084] MsiCloseHandle (hAny=0x15) returned 0x0 [0081.085] MsiViewFetch (hView=0x13, phRecord=0x32f528) returned 0x0 [0081.086] MsiCreateRecord (cParams=0x2) returned 0x17 [0081.087] MsiRecordSetStringW (hRecord=0x17, iField=0x0, szValue="-- CUSTOM ACTION -- Create file: C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files.cab") returned 0x0 [0081.087] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x17) returned 0 [0081.088] MsiCloseHandle (hAny=0x17) returned 0x0 [0081.089] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files.cab" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0081.089] MsiCreateRecord (cParams=0x2) returned 0x18 [0081.090] MsiRecordSetStringW (hRecord=0x18, iField=0x0, szValue="-- CUSTOM ACTION -- Read stream") returned 0x0 [0081.090] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x18) returned 0 [0081.092] MsiCloseHandle (hAny=0x18) returned 0x0 [0081.092] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="MSCF", pcbDataBuf=0x32f520) returned 0x0 [0081.093] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.094] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.095] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.095] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x5e\x83\x7d\x10\xfe\x5f\x74\x1a\x83\x7d\x10\xff\x74\x14\x6a", pcbDataBuf=0x32f520) returned 0x0 [0081.096] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.096] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x83\xe4\xf8\x83\xec\x5c\x53\x56\x57\xff\x75\x08\xb9\xb0\x57\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.097] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.097] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xce\x89\x4d\x08\x85\xf6\x74\x3c\x8b\x45\x0c\x53\x85\xc0\x74\x08\x3b\xb0\x80", pcbDataBuf=0x32f520) returned 0x0 [0081.097] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.098] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0cf\x8bFX\x80¿\x90", pcbDataBuf=0x32f520) returned 0x0 [0081.098] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.098] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.099] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.099] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.100] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.100] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="]Â\x08", pcbDataBuf=0x32f520) returned 0x0 [0081.101] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.101] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xeb\xc4\xff\x73\x54\x57\xe8\x94\x57\x08", pcbDataBuf=0x32f520) returned 0x0 [0081.101] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.101] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x59\x8b\xc6\x5e\xc2\x04", pcbDataBuf=0x32f520) returned 0x0 [0081.102] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.102] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="-ÿ\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.103] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.103] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="5xRL", pcbDataBuf=0x32f520) returned 0x0 [0081.104] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.104] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x3c\xff\xff\xff\x47\xeb\xde\xb3\x01\x89\x75\xf0\xe9\x32\xff\xff\xff\x85\xf6\x74\x40\x84\xdb\x75\x46\x33\xc0\x8d\x4d\xe0\x66\x89\x84\x75\xd4\xdf\xff\xff\x8d\x85\xd4\xdf\xff\xff\x50\xe8\x97\x40", pcbDataBuf=0x32f520) returned 0x0 [0081.105] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.105] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x98\x58\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.105] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.106] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x85\xf6\x74\x15\x8d\x46\xff\x50\x52\x57\xe8\xd7\xfb\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.106] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.106] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc3\x33\xf6\xeb\xef\x55\x8b\xec\x83\xec\x0c\x53\x56\xff\x15\x34\xf7\x48", pcbDataBuf=0x32f520) returned 0x0 [0081.107] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.107] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.108] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.108] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xe9\x5a\xff\xff\xff\x6a\x08\x58\xeb\xe9\xdd\xd9\xdd\xd8\xeb\xe1\x55\x8b\xec\x8b\x4d\x0c\x83\xf9\x02\x72\x43\x53\x56\x57\x6a", pcbDataBuf=0x32f520) returned 0x0 [0081.109] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.109] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x32\xdb\xeb\xea\x55\x8b\xec\x51\x8b\x41\x2c\x83\xf8\x04\x75\x0d\xff\x75\x08\xe8\x62\xff\xff\xff\x59\x5d\xc2\x04", pcbDataBuf=0x32f520) returned 0x0 [0081.109] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.109] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x51\x53\x8b\x5d\x08\x33\xc0\x56\x8b\xf1\x57\x66\x89\x03\x8d\x7e\x18\x8b\xcf\xe8\x04\x25", pcbDataBuf=0x32f520) returned 0x0 [0081.110] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.110] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="Pj", pcbDataBuf=0x32f520) returned 0x0 [0081.111] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.111] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xa8", pcbDataBuf=0x32f520) returned 0x0 [0081.112] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.112] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xdc", pcbDataBuf=0x32f520) returned 0x0 [0081.112] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.112] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x12\x12\x12\x12\n\x12\x0b\x12\x0c\r\x0e\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x12\x0f\x12\x10\x11U\x8bìVW\x8b}\x083öÿ7ÿ4µ KJ", pcbDataBuf=0x32f520) returned 0x0 [0081.113] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.113] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xec\xff\xff\x84\xc0\x0f\x84\xe4", pcbDataBuf=0x32f520) returned 0x0 [0081.114] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.114] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xe3\xeb\xee\x55\x8b\xec\x8b\x0d\xa4\x62\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.115] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.115] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\xf8\x59\x85\xff\x0f\x84\x9b", pcbDataBuf=0x32f520) returned 0x0 [0081.116] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.116] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x08", pcbDataBuf=0x32f520) returned 0x0 [0081.116] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.116] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xe8\xe8\x91\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.117] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.117] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\x01\x83\xf8\x01\x7f\x69\x53\x8b\x5d\x08\x57\x8b\x7b\x04\x89\x7e\x04\x8d\x47\x01\x39\x46\x08\x72\x1e\x8b\x46\x04\x8d\x04\x45\x02", pcbDataBuf=0x32f520) returned 0x0 [0081.118] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.118] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x5d\xc3\xff\x77\x1c\x8b\xcb\xe8\x4c\x02", pcbDataBuf=0x32f520) returned 0x0 [0081.119] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.119] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.119] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.120] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x95\x32\xc0\xeb\x91\x8d\x49", pcbDataBuf=0x32f520) returned 0x0 [0081.120] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.120] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.121] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.121] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="!èº\x05", pcbDataBuf=0x32f520) returned 0x0 [0081.122] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.122] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xea\xf7\x43", pcbDataBuf=0x32f520) returned 0x0 [0081.123] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.123] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0d\xe3\xff\xff\x89\x46\x08\x8b\xc6\x5e\x5d\xc2\x04", pcbDataBuf=0x32f520) returned 0x0 [0081.123] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.124] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x01\x0f\x84\x17\x15", pcbDataBuf=0x32f520) returned 0x0 [0081.124] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.124] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="f\x8b", pcbDataBuf=0x32f520) returned 0x0 [0081.125] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.125] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b", pcbDataBuf=0x32f520) returned 0x0 [0081.126] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.126] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="p", pcbDataBuf=0x32f520) returned 0x0 [0081.127] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.127] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.127] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.127] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.128] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.128] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x12±@", pcbDataBuf=0x32f520) returned 0x0 [0081.129] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.129] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x7b\x08\x83\xf9\x02\x0f\x85\xc9\x58\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.129] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.130] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x10\xe9\x54\xfe\xff\xff\x49\x83\xf9\x09\x0f\x87\xe9\x05", pcbDataBuf=0x32f520) returned 0x0 [0081.130] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.131] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\xff\x57\x8b\xce\xe8\xb6\xd3\xff\xff\xe9\xda\xf9\xff\xff\x8b\xcb\xe8\x57\x37\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.131] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.131] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x4a\xb4\xff\xff\x8b\x45\x08\x33\xff\x8b\xf7\x8b\x38\x57\xff\x34\xb5\x30\x52\x4a", pcbDataBuf=0x32f520) returned 0x0 [0081.132] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.132] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x75\x08\xe8\xe9\xd4\xff\xff\x85\xc0\x0f\x88\xff\x58\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.133] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.133] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0c\x05\x8b\x16\x89\x5d\xdc\xc7\x45\xe0\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.134] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.134] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\x18\x89\x5d\xd0\xc7\x45\xf4", pcbDataBuf=0x32f520) returned 0x0 [0081.134] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.134] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xfb\x01\xe9\xb2\xfb\xff\xff\xff\x75\xcc\x6a\x6e\xe9\x2e\x55\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.135] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.135] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xe8\x0b\xc0\xff\xff\x8b\x4f\x04\x8b\x45\x0c\x8b\x04\x81\x66\x83\x78\x08", pcbDataBuf=0x32f520) returned 0x0 [0081.136] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.136] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="Z\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.137] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.137] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x66\x89\x4e\x0a\x66\x83\xf8\x3f\x0f\x8e\x68\x58\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.137] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.137] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.138] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.138] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc2\x02\x4b\x75\xeb\x8b\x41\x04\x39\x45\xe0\x0f\x82\x78\x02", pcbDataBuf=0x32f520) returned 0x0 [0081.139] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.139] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x83\xff\x40\x7d\x16\x8b\x84\x8d\x7c\xfe\xff\xff\x89\x84\xbe\x10\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.140] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.140] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xe9\x9c\xfe\xff\xff\x8b\xf8\xe9\xf6\xfd\xff\xff\xff\x36\xe8\x79\x1d\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.140] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.141] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x1c\xa1\x64\x64\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.141] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.141] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xa4\x54\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.142] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.142] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\xe8\x0b\x03\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.143] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.143] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.144] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.144] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="pÇF\x08", pcbDataBuf=0x32f520) returned 0x0 [0081.145] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.145] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\x45\x0c\x8b\x48\x04\x8b\x4c\x99\x04\xe8\xfd\x92\xff\xff\x89\x44\x24\x28\x83\xec\x10\x8d\x44\x24\x40\x8b\xcc\x50\x83\x61\x08", pcbDataBuf=0x32f520) returned 0x0 [0081.145] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.146] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.146] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.146] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x02\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x04\x03\x90´\\D", pcbDataBuf=0x32f520) returned 0x0 [0081.147] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.147] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x45\xf0\x89\x75\xf0\x8d\x8d\x7c\xff\xff\xff\x50\x46\xe8\x92\xea", pcbDataBuf=0x32f520) returned 0x0 [0081.148] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.148] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x01\x89\x44\x24\x1c\x8b\x41\x04\x89\x44\x24\x20\x8b\x41\x08\x89\x44\x24\x24\x8b\x41\x0c\x89\x44\x24\x28\xff", pcbDataBuf=0x32f520) returned 0x0 [0081.149] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.149] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.149] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.150] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x24\xe8\x72\x45\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.150] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.150] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x87\xb8\x45\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.151] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.151] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x24\x30\x8b\xcf\x50\xe8\xeb\x76\xff\xff\x85\xc0\x0f\x84\x6d\x43\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.152] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.152] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x24\x68\xe8\x69\x6d\xff\xff\x5f\x5e\x33\xc0\x5b\x8b\xe5\x5d\xc2\x08", pcbDataBuf=0x32f520) returned 0x0 [0081.152] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.153] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.153] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.153] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0c\x06¡hTJ", pcbDataBuf=0x32f520) returned 0x0 [0081.154] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.154] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\xff\x8b\x46\x08\x8b", pcbDataBuf=0x32f520) returned 0x0 [0081.155] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.155] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\x46\x28\x8d\x8f\xf0\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.156] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.156] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\xff\x6a\xff\xe9\x4b\x37\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.156] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.156] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\xff\xf7\xc1", pcbDataBuf=0x32f520) returned 0x0 [0081.157] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.157] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.158] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.158] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x03\xc1\x0f\xb7\x04\x45\x60\x55\x4a", pcbDataBuf=0x32f520) returned 0x0 [0081.159] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.159] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0c\x81\x8b\x01\x89\x45\xc8\x8b\x86\x94", pcbDataBuf=0x32f520) returned 0x0 [0081.159] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.159] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.160] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.160] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\xff\xff\x8b\x75\xe4\xdd\xda\xdd\xd8\x89\x75\xec\xdd\xd8\x33\xc0\xc7\x45\xd0\x08", pcbDataBuf=0x32f520) returned 0x0 [0081.161] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.161] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xec\x83\xec\x10\x53\x56\x8b\xf1\x57\x33\xff\x39\x7e\x14\x74\x59\x80\x7e\x10", pcbDataBuf=0x32f520) returned 0x0 [0081.162] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.162] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x08\x89\x08\x89\x06\xb0\x01\x5e\x5d\xc2\x04", pcbDataBuf=0x32f520) returned 0x0 [0081.162] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.163] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x15\x8d\x45\xfc\x33\xd2\x50\x6a\x0b\x8b\xce\xe8\x19\xa4", pcbDataBuf=0x32f520) returned 0x0 [0081.163] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.163] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.164] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.164] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.165] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.165] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x13\x0f\x84ª", pcbDataBuf=0x32f520) returned 0x0 [0081.165] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.166] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8d\x04\x0a\x8b\x4d\x2c\x8b\x55\xf0\x89\x01\x85\xd2\x74\x44\x8b\x8d\x5c\xff\xff\xff\x3b\xd1\x76\x43\x8b\xc3\x2b\xc2\x83\xe0\xfe\x50\x52\x51\xe8\x38\x0c\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.166] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.166] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x84\xf2\xc4\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.167] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.167] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xd2\x75\x18\x8b\x45\x84\x89\x45\x94\x8b\x45\x90\x89\x45\xd4\x8b\x45\xd8\x89\x45\x9c\x8b\x45\xe0\x89\x45\xa0\x8b\xc2\x89\x4d\xb0\x2b\xc7\xf7\xd8\x1b\xc0\x83\xe0\x02\x89\x45\x98\x33\xc0\x89\x45\xc8\x85\xdb\x0f\x85\xec\x06", pcbDataBuf=0x32f520) returned 0x0 [0081.168] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.168] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xf8\xff\xff\x6a\x02\x58\x6a\x0d\x89\x45\xe8\x58\x3b\xf8\x0f\x84\xdc\xc2\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.169] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.169] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x7f\x8b\xcf\x89\x4d\xfc\x8b\x45\x08\x33\xdb\x8b\x75\x10\x89\x75\xf4\xa8\x01\x0f\x85\x99\xc2\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.169] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.169] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x90", pcbDataBuf=0x32f520) returned 0x0 [0081.170] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.170] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0f…³\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.171] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.171] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.172] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.172] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.173] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.173] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc7\x05\xe4\xf7\x4b", pcbDataBuf=0x32f520) returned 0x0 [0081.173] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.173] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.174] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.174] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc7\x05\x18\xfc\x4b", pcbDataBuf=0x32f520) returned 0x0 [0081.175] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.175] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.176] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.176] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc7\x05\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.176] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.176] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.177] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.177] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc7\x05\x80\x04\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.178] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.178] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.179] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.179] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc7\x05\xac\x08\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.179] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.179] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc4\x0a\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.180] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.180] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.181] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.181] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xf8\x0e\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.182] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.182] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.182] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.183] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf=",\x13L", pcbDataBuf=0x32f520) returned 0x0 [0081.183] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.183] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.184] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.184] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="`\x17L", pcbDataBuf=0x32f520) returned 0x0 [0081.185] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.185] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.185] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.186] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x94\x1b\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.186] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.186] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="-A", pcbDataBuf=0x32f520) returned 0x0 [0081.187] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.187] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc8\x1f\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.188] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.188] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x14I", pcbDataBuf=0x32f520) returned 0x0 [0081.188] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.189] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xf4\x23\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.189] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.189] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="L", pcbDataBuf=0x32f520) returned 0x0 [0081.190] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.190] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.191] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.191] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="L", pcbDataBuf=0x32f520) returned 0x0 [0081.192] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.192] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.192] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.193] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x7c\xbd\x83\xff\xff\x75\x20\xb0\x01\x5f\x5e\x5b\x8b\xe5\x5d\xc3\x83\xf8\x41\x0f\x82\x58\x5e\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.193] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.193] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\x46\x14\x89\x47\x14\x8a\x46\x18\x88\x47\x18\x8d\x46\x20\x83\x61\x08", pcbDataBuf=0x32f520) returned 0x0 [0081.194] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.194] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x57\x8b\xfa\x41\x89\x7d\xf4\x33\xd2\x89\x4d\xf8\x0f\xb7\x03\x8d\x73\x04\xb9\x85", pcbDataBuf=0x32f520) returned 0x0 [0081.195] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.195] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.195] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.195] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8d\x45\xe8\x50\xff\x77\x08\xe8\x19\x50\xfe\xff\xff\x75\xe8\x68\x28\x1d\x49", pcbDataBuf=0x32f520) returned 0x0 [0081.196] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.196] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.197] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.197] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x5e\x5f\xc3\x90\x8a\x06\x88\x07\x8a\x46\x01\x88\x47\x01\x8b\x44\x24\x0c\x5e\x5f\xc3\x8d\x49", pcbDataBuf=0x32f520) returned 0x0 [0081.198] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.198] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x7e\x05\x0f\xb6\x42\x05\x2b\xf8\x74\x16\x33\xc9\x85\xff\x0f\x9f\xc1\x8d\x0c\x4d\xff\xff\xff\xff\x85\xc9\x0f\x85\xe8\x07", pcbDataBuf=0x32f520) returned 0x0 [0081.199] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.199] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x83\xfb\x1f\x0f\x87\x15\x04", pcbDataBuf=0x32f520) returned 0x0 [0081.199] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.200] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x74\x12\x33\xc9\x85\xff\x0f\x9f\xc1\x8d\x0c\x4d\xff\xff\xff\xff\x85\xc9\x75\x24\x0f\xb6\x4e\xff\x0f\xb6\x42\xff\x2b\xc8\x74\x12\x33\xc0\x85\xc9\x0f\x9f\xc0\x8d\x0c\x45\xff\xff\xff\xff\xeb\x02\x33\xc9\x85\xc9\x75\x02\x33\xc9\x8b\xc1\x5f\xe9\xe6\x0d", pcbDataBuf=0x32f520) returned 0x0 [0081.200] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.200] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0f\xb6\x7e\xfc\x0f\xb6\x42\xfc\x2b\xf8\x74\x16\x33\xc9\x85\xff\x0f\x9f\xc1\x8d\x0c\x4d\xff\xff\xff\xff\x85\xc9\x0f\x85\x2e\xfc\xff\xff\x0f\xb6\x7e\xfd\x0f\xb6\x42\xfd\x2b\xf8\x74\x16\x33\xc9\x85\xff\x0f\x9f\xc1\x8d\x0c\x4d\xff\xff\xff\xff\x85\xc9\x0f\x85\x0c\xfc\xff\xff\x0f\xb6\x4e\xfe\x0f\xb6\x42\xfe\x2b\xc8\x74\x12\x33\xc0\x85\xc9\x0f\x9f\xc0\x8d\x0c\x45\xff\xff\xff\xff\xeb\x02\x33\xc9\x85\xc9\x0f\x85\xe6\xfb\xff\xff\x0f\xb6\x42\xff\x0f\xb6\x4e\xff\x2b\xc8\x0f\x84\xd6\xfb\xff\xff\x33\xc0\x85\xc9\x0f\x9f\xc0\x8d\x0c\x45\xff\xff\xff\xff\xe9\xc3\xfb\xff\xff\x8b\x46\xe2\x3b\x42\xe2\x0f\x84\x81", pcbDataBuf=0x32f520) returned 0x0 [0081.201] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.201] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\xff\x85\xc9\x0f\x85\x5e\xf8\xff\xff\x0f\xb6\x42\xf9\x0f\xb6\x4e\xf9\x2b\xc8\x74\x12\x33\xc0\x85\xc9\x0f\x9f\xc0\x8d\x0c\x45\xff\xff\xff\xff\xeb\x02\x33\xc9\x85\xc9\x0f\x85\x38\xf8\xff\xff\x8b\x46\xfa\x3b\x42\xfa\x0f\x84\x81", pcbDataBuf=0x32f520) returned 0x0 [0081.202] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.202] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x85\xff\x0f\x9f\xc1\x8d\x0c\x4d\xff\xff\xff\xff\x85\xc9\x0f\x85\x6c\xf4\xff\xff\x0f\xb6\x7e\xf6\x0f\xb6\x42\xf6\x2b\xf8\x74\x16\x33\xc9\x85\xff\x0f\x9f\xc1\x8d\x0c\x4d\xff\xff\xff\xff\x85\xc9\x0f\x85\x4a\xf4\xff\xff\x0f\xb6\x7e\xf7\x0f\xb6\x42\xf7\x2b\xf8\x74\x16\x33\xc9\x85\xff\x0f\x9f\xc1\x8d\x0c\x4d\xff\xff\xff\xff\x85\xc9\x0f\x85\x28\xf4\xff\xff\x0f\xb6\x4e\xf8\x0f\xb6\x42\xf8\x2b\xc8\x74\x12\x33\xc0\x85\xc9\x0f\x9f\xc0\x8d\x0c\x45\xff\xff\xff\xff\xeb\x02\x33\xc9\x85\xc9\x0f\x85\x02\xf4\xff\xff\x8b\x46\xf9\x3b\x42\xf9\x0f\x84\x81", pcbDataBuf=0x32f520) returned 0x0 [0081.202] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.203] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x75\x14\x8d\x46\x10\x3b\xc6\x72\x3e\x50\x53\xe8\x64\x5b", pcbDataBuf=0x32f520) returned 0x0 [0081.203] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.203] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="M\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.204] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.204] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x55\x8b\xec\x83\x7d\x10\x0a\x8b\x45\x08\x56\x75\x0a\x85\xc0\x79\x06\x6a\x01\x6a\x0a\xeb\x05\x6a", pcbDataBuf=0x32f520) returned 0x0 [0081.205] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.205] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\nU", pcbDataBuf=0x32f520) returned 0x0 [0081.205] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.206] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.206] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.206] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\x15\x7c\xf2\x48", pcbDataBuf=0x32f520) returned 0x0 [0081.207] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.207] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc0\x02\x0f\xb7\x30\x66\x85\xf6\x75\xf0\x33\xd2\x66\x39\x10\x74\x0b\x83\xc1\x02\x0f\xb7\x11\x66\x85\xd2\x75\xd5\x33\xc0\x8b\xf1\x66\x39\x01\x74\x3e\x0f\xb7\x1f\x33\xd2\x8b\xc7\x66\x85\xdb\x74\x1b\x0f\xb7\x11\x89\x55\x08\x8b\xd3\x66\x3b\x55\x08\x74\x0b\x83\xc0\x02\x0f\xb7\x10\x66\x85\xd2\x75\xef\x33\xd2\x66\x39\x10\x75\x0a\x83\xc1\x02\x66\x39\x11\x75\xd1\xeb\x08\x33\xc0\x66\x89\x01\x83\xc1\x02\x8b\x45\xfc\x5f\x89\x48\x1c\x8b\xc6\x2b\xc1\xf7\xd8\x1b\xc0\x23\xc6\x5e\x5b\x8b\xe5\x5d\xc3\x55\x8b\xec\x8b\x4d\x08\x85\xc9\x75\x15\xe8\x3f\x46", pcbDataBuf=0x32f520) returned 0x0 [0081.208] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.208] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xd2\x8b\xc7\xf7\x75\x0c\xe9\xd6\xfe\xff\xff\x6a\x0c\x68\x70\x9f\x4b", pcbDataBuf=0x32f520) returned 0x0 [0081.208] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.209] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x85\xc0\x8b\x45\x08\x59\x75\x08\x0f\xb7\xc0\x0f\xb7\xc0\xeb\x2a\x0f\xb7\xc8\x8b\x86\x94", pcbDataBuf=0x32f520) returned 0x0 [0081.209] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.209] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x7f\x02t\x05èD±", pcbDataBuf=0x32f520) returned 0x0 [0081.210] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.210] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x75\x08\x8b\x7d\xe4\x56\xe8\x72\x18", pcbDataBuf=0x32f520) returned 0x0 [0081.211] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.211] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xdb\x59\xeb\x03\x8b\x7d\x0c\x56\xe8\x38\xf2\xff\xff\x8b\x46\x0c\x59\x84\xc0\x79\x08\x83\xe0\xfc\x89\x46\x0c\xeb\x16\xa8\x01\x74\x12\xa8\x08\x74\x0e\xa9", pcbDataBuf=0x32f520) returned 0x0 [0081.212] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.212] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\xff\xe8\x58\xba", pcbDataBuf=0x32f520) returned 0x0 [0081.212] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.212] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xb8\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.213] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.213] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="J\x9e", pcbDataBuf=0x32f520) returned 0x0 [0081.214] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.214] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x9a", pcbDataBuf=0x32f520) returned 0x0 [0081.215] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.215] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="RL", pcbDataBuf=0x32f520) returned 0x0 [0081.215] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.215] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\xf2\x99\x8b\xd8\x2b\xd9\x1b\xd6\x89\x55\x08\x8b\xf2\xeb\x0f\x8b\x07\x99\x8b\xd8\x8b\xf2\x8b\x45\xfc\x99\x2b\xd8\x1b\xf2\x6a", pcbDataBuf=0x32f520) returned 0x0 [0081.216] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.216] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\x75\x20\xff\x75\x18\xff\x75\x14\x6a\x02\xff\x70\x0c\xe8\x4d\x02", pcbDataBuf=0x32f520) returned 0x0 [0081.217] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.217] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x66\x89\x45\xf6\x66\x8b\x02\x33\xd2\x52\x66\x89\x45\xf8\x33\xc0\x66\x89\x45\xfa\x8d\x45\xec\x52\x57\x50\x52\xff\xb1\x60\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.218] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.218] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x5d\x0c\x74\x1b\x8b\x45\xf8\x83\xc7\x02\x66\x89\x01\x8b\x4d\x08\x8b\x45\xfc\x83\xc1\x02\x48\x89\x4d\x08\x89\x45\xfc\xeb\x40\x39\x75\x14\x74\x7c\x83\xc7\x02\x8b\xc6\x66\x83\x3f\x23\x75\x06\x33\xc0\x40\x83\xc7\x02\x50\x52\x8d\x45\xfc\x50\x8d\x45\x08\x50\xff\x75\x14\x0f\xb7\x07\x50\x8d\x45\xe4\x50\xe8\x1b\xf5\xff\xff\x83\xc4\x1c\x85\xc0\x74\x20\x8b\x4d\x08\x83\xc7\x02\x8b\x45\xfc\x8b\x55\x18\x85\xc0\x75\x82\x85\xc0\x74\x16\x33\xc0\x8b\xf3\x66\x89\x01\x2b\x75\xfc\xeb\x3a\x39\x75\xfc\x76\x05\x33\xc0\x40\xeb\x02\x8b\xc6\x8b\x4d\xf4\x33\xd2\x66\x89\x11\x85\xc0\x75\x12\x39\x55\xfc\x77\x0d\xe8\x80\x0f", pcbDataBuf=0x32f520) returned 0x0 [0081.218] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.218] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xf8\x8d\x49", pcbDataBuf=0x32f520) returned 0x0 [0081.219] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.219] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x47\x03\x8a\x46\x02\x88\x47\x02\x8b\x44\x24\x0c\x5e\x5f\xc3\x90\x8a\x46\x03\x88\x47\x03\x8a\x46\x02\x88\x47\x02\x8a\x46\x01\x88\x47\x01\x8b\x44\x24\x0c\x5e\x5f\xc3\x8d\xa4\x24", pcbDataBuf=0x32f520) returned 0x0 [0081.220] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.220] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="=À\x06\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.221] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.221] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0c0èG;", pcbDataBuf=0x32f520) returned 0x0 [0081.222] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.222] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="W\x8b\x86\x84", pcbDataBuf=0x32f520) returned 0x0 [0081.222] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.222] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.223] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.223] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x53\x56\xff\x75\x08\x8b\x75\x0c\xe8\x36\xfb\xff\xff\x8b\xd8\x59\x85\xdb\x75\x0e\x56\xe8\x97\xfb\xff\xff\x59\x33\xc0\xe9\xa9\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.224] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.224] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.225] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.225] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="AL", pcbDataBuf=0x32f520) returned 0x0 [0081.225] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.226] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xf6", pcbDataBuf=0x32f520) returned 0x0 [0081.226] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.226] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.227] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.227] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x66\x3b\xc1\x76\x1e\x8b\x45\xfc\x8b\x7d\x0c\x83\xee\x02\xa8\x08\x75\x5f\x85\xff\x74\x03\x8b\x75\x08\x33\xdb\xe9\x99", pcbDataBuf=0x32f520) returned 0x0 [0081.228] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.228] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xb9\xff\xff", pcbDataBuf=0x32f520) returned 0x0 [0081.228] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.229] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.229] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.229] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="joZ;Â\x0f…_\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.230] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.230] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xfb\xff\xff\x50\xe8\x42\x02", pcbDataBuf=0x32f520) returned 0x0 [0081.231] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.231] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x06\x81Ï", pcbDataBuf=0x32f520) returned 0x0 [0081.232] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.232] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x58\xe9\xee\xfc\xff\xff\x6a\x0a\x58\x83\xea\x02\x6a\x0a\x59\x3b\xc1\x0f\x85\xdd\xfc\xff\xff\xe9\x70\xff\xff\xff\x8b\x55\xb4\xe9\x68\xff\xff\xff\x33\xc0\x8b\xf3\x40\x89\x45\x90\xeb\x25\x66\x3b\x4d\xa0\x77\x42\x6b\xce\x0a\x8b\x75\x98\x0f\xb7\xf6\x83\xc6\xd0\x03\xf1\x81\xfe\x50\x14", pcbDataBuf=0x32f520) returned 0x0 [0081.232] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.232] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.233] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.233] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.234] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.234] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x89\x41\x20\x8b\x45\x18\xdd", pcbDataBuf=0x32f520) returned 0x0 [0081.235] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.235] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x09\xc7\x46\x64\x8a", pcbDataBuf=0x32f520) returned 0x0 [0081.235] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.236] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.236] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.236] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.237] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.237] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\x15\xe4\xf1\x48", pcbDataBuf=0x32f520) returned 0x0 [0081.238] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.238] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xbd\x34\xe5\xff\xff\x89\x85\x3c\xe5\xff\xff\x85\xc0\x0f\x84", pcbDataBuf=0x32f520) returned 0x0 [0081.239] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.239] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xe9\x64\x08", pcbDataBuf=0x32f520) returned 0x0 [0081.239] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.239] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.240] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.240] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xa0\xfd\xff\xff\x50\xe8\x74\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.241] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.241] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x85\xdb\x74\x9a\x51\x53\x56\xff\x75\x14\x6a\x01\xff\x75\x24\xff\x15\x84\xf1\x48", pcbDataBuf=0x32f520) returned 0x0 [0081.242] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.242] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xd0\x2d\xff\xe1\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.243] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.243] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0f\x12L$\x0cf\x0fÅÁ\x03%", pcbDataBuf=0x32f520) returned 0x0 [0081.243] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.244] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xf2\x0f\x58\xc1\xf2\x0f\x59\xc7\xf2\x0f\x59\xf0\xf2\x0f\x58\xc6\x66\x0f\xc5\xc0\x03\x25\xf0\x7f", pcbDataBuf=0x32f520) returned 0x0 [0081.244] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.244] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\xff\xff\xd9\xc9\x8a\xad\x61\xff\xff\xff\xd0\xe5\xd0\xfd\xd0\xc5\x8a\xc5\x24\x0f\xd7\x8a\xe0\xd0\xe1\xd0\xf9\xd0\xc1\x8a\xc1\x24\x0f\xd7\xd0\xe4\xd0\xe4\x0a\xc4\x0f\xbe\xc0\x81\xe1\x04\x04", pcbDataBuf=0x32f520) returned 0x0 [0081.245] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.245] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="E\x18u\x0bÝ\x05`íK", pcbDataBuf=0x32f520) returned 0x0 [0081.246] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.246] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x02f9\x06tøj\x03Vh¤|I", pcbDataBuf=0x32f520) returned 0x0 [0081.247] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.247] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x74\x1a\xff\x76\x08\xe8\xc3\x21\xff\xff\x81\x66\x0c\xf7\xfb\xff\xff\x33\xc0\x59\x89\x06\x89\x46\x08\x89\x46\x04\x5e\x5d\xc3\x55\x8b\xec\x57\x8b\x7d\x08\x85\xff\x75\x15\xe8\x71\x7f\xff\xff\xc7", pcbDataBuf=0x32f520) returned 0x0 [0081.247] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.248] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="j", pcbDataBuf=0x32f520) returned 0x0 [0081.248] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.248] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x45\xf0\x8b\x5d\xe8\x3b\x45\x0c\x74\x07\x50\xe8\xed\x19\xff\xff\x59\x83\xfb\xfe\x74\x02\x8b\xfb\x8b\xc7\xe9\x6e\x02", pcbDataBuf=0x32f520) returned 0x0 [0081.249] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.249] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.250] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.250] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x81\xf9", pcbDataBuf=0x32f520) returned 0x0 [0081.251] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.251] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xe0\x66\x0f\xc5\xc4", pcbDataBuf=0x32f520) returned 0x0 [0081.251] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.251] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0eJ", pcbDataBuf=0x32f520) returned 0x0 [0081.252] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.252] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xf2\x0f\x59\xc9\x66\x0f\x58\xf2\x66\x0f\x59\xe0\xf2\x0f\x59\xcb\x66\x0f\x58\xf4\x66\x0f\x70\xc5\xee\x66\x0f\x59\xce\x66\x0f\x70\xf5\xee\xf2\x0f\x5c\xc7\x66\x0f\x70\xd1\xee\xf2\x0f\x5c\xe9\xf2\x0f\x5c\xf0\xf2\x0f\x5c\xea\xf2\x0f\x5c\xfe\xf2\x0f\x5c\xef\xf2\x0f\x58\xc5\x66\x0f\x13\x44\x24\x04\xdd\x44\x24\x04\x83\xc4\x10\xc3\x2d\xfc\x3b", pcbDataBuf=0x32f520) returned 0x0 [0081.253] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.253] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x66\x0f\xd7\xc7\x66\x0f\x73\xf0\x01\x66\x0f\x54\x3d\xc0\xbb\x49", pcbDataBuf=0x32f520) returned 0x0 [0081.254] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.254] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x0f\x12D$\x04f\x0fWö\x83ì\x10ò\x0f\x10øf\x0fÅÐ\x03\x81âð\x7f", pcbDataBuf=0x32f520) returned 0x0 [0081.254] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.254] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x58\xe8\xf2\x0f\x58\xdf\xf2\x0f\x58\xcd\xf2\x0f\x58\xcb\xf2\x0f\x58\xce\x66\x0f\x15\xf6\xf2\x0f\x58\xce\x83\xec\x10\xf2\x0f\x58\xe1\x66\x0f\x13\x64\x24\x04\xdd\x44\x24\x04\x83\xc4\x10\xc3\x7f\x2b\x66\x0f\xc5\xc0\x03\x66\x25\xff\x7f\x66\x0f\xc4\xc0\x03\x83\xec\x10\x66\x0f\x12\x0d\x90\xdb\x49", pcbDataBuf=0x32f520) returned 0x0 [0081.255] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.255] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\x8b\x45\x10\xd9\xe8\xdd\x18\xe9\xe6", pcbDataBuf=0x32f520) returned 0x0 [0081.256] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.256] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\xec\x8b\x4d\x08\x85\xc9\x75\x15\xe8\xb2\x50\xff\xff\xc7", pcbDataBuf=0x32f520) returned 0x0 [0081.257] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.257] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x16\x0f·\x05B;L", pcbDataBuf=0x32f520) returned 0x0 [0081.258] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.258] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x04è\x8f\r", pcbDataBuf=0x32f520) returned 0x0 [0081.258] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.258] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x33\xc0\x66\x89\x06\xe8\xfe\x44\xff\xff\x6a\x16\x5e\x89\x30\xe8\x82\x47\xff\xff\x8b\xc6\x5e\x5d\xc3\x57\x8b\xfe\x2b\xf9\x0f\xb7\x01\x66\x89\x04\x0f\x8d\x49\x02\x66\x85\xc0\x74\x03\x4a\x75\xee\x33\xc0\x5f\x85\xd2\x75\xdf\x66\x89\x06\xe8\xc9\x44\xff\xff\x6a\x22\xeb\xc9\x55\x8b\xec\x8b\x45\x10\x83\xec\x14\x56\x57\x8b\x7d\x08\x33\xf6\x85\xff\x74\x0d\x85\xc0\x0f\x84\x3f\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.259] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.259] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\x75\x08\xff\xd0\x5d\xc3\xff\x75\x1c\xff\x75\x18\xff\x75\x14\xff\x75\x10\xff\x75\x0c\xff\x75\x08\xe8\x16\xff\xff\xff\x59\x50\xff\x15\xdc\xf3\x48", pcbDataBuf=0x32f520) returned 0x0 [0081.260] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.260] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc2\x8b\x35\xf0\x31\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.261] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.261] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x74\x15\x3b\xfe\x73\x11\x2b\xf7\x8d\x04\x1f\x56\x6a", pcbDataBuf=0x32f520) returned 0x0 [0081.261] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.261] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xd7\xfe\xff\xff\xb6\xd8", pcbDataBuf=0x32f520) returned 0x0 [0081.262] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.262] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.263] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.263] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x3b\xc2\x0f\x82\xc1", pcbDataBuf=0x32f520) returned 0x0 [0081.264] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.264] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xf4\x57\x50\xe8\x9e\x4c\xff\xff\x59\x59\x8b\xc8\x83\xf9\xff\x74\xc6\x46\x3b\x75\xf0\x7c\xce\x66\x8b\x45\x08\xeb\x1f\x83\x47\x04\xfe\x8b\x45\x08\x78\x0a\x8b\x0f\x66\x89\x01\x83\x07\x02\xeb\x0c\x0f\xb7\xc0\x57\x50\xe8\x85\x2d", pcbDataBuf=0x32f520) returned 0x0 [0081.264] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.264] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\x4d\xd0\x40\xd3\xe0\x85\x44\x95\xf0\x0f\x84\x92", pcbDataBuf=0x32f520) returned 0x0 [0081.265] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.265] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x05\x48\x83\xc8\xe0\x40\x2b\xc8\x89\x5d\xd4\x33\xc0\x40\xd3\xe0\x89\x45\xc8\x8b\x44\x95\xf0\x8b\x4d\xc8\x03\xc8\x89\x4d\xd8\x3b\xc8\x8b\x45\xd8\x8b\xcb\x6a\xff\x5f\x72\x05\x3b\x45\xc8\x73\x06\x33\xc9\x41\x89\x4d\xd4\x89\x44\x95\xf0\x4a\x78\x2e\x85\xc9\x74\x27\x8b\x44\x95\xf0\x8b\xcb\x89\x5d\xd4\x8d\x78\x01\x3b\xf8\x89\x7d\xd8\x8b\xc7\x72\x05\x83\xf8\x01\x73\x06\x33\xc9\x41\x89\x4d\xd4\x89\x44\x95\xf0\x4a\x79\xd5\x83\xcf\xff\x8b\x4d\xd0\x8b\x55\xc4\x8b\xc7\xd3\xe0\x21\x44\x95\xf0\x8d\x42\x01\x3b\xc6\x7d\x11\x8d\x7d\xf0\x8b\xce\x8d\x3c\x87\x2b\xc8\x33\xc0\xf3\xab\x83\xcf\xff\x8b\x4d\xe0\x39\x5d\xd4\x74\x01\x41\x8b\x15\x2c\xf1\x4b", pcbDataBuf=0x32f520) returned 0x0 [0081.266] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.266] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x54\xb5\xf0\x46\x89\x45\xe0\x83\xfe\x03\x7c\xdf\x8b\x7d\xd8\x8d\x55\xf8\x8b\x75\xc8\x8b\xc7\xc1\xe0\x02\x6a\x02\x2b\xd0\x33\xdb\x59\x3b\xcf\x7c\x08\x8b\x02\x89\x44\x8d\xf0\xeb\x04\x89\x5c\x8d\xf0\x83\xea\x04\x49\x79\xea\x8b\x7d\xc0\x6a\x1f\x58\x2b\x05\x34\xf1\x4b", pcbDataBuf=0x32f520) returned 0x0 [0081.267] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.267] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x74\x13\x85\xff\x0f\x94\xc1\xfe\xc9\x80\xe1\xe0\x80\xc1\x70\x88\x08\xc6\x40\x03", pcbDataBuf=0x32f520) returned 0x0 [0081.267] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.267] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x57\x57\xe8\xbf\x18\xff\xff\xcc\x55\x8b\xec\x83\xec\x2c\xa1\x50\xed\x4b", pcbDataBuf=0x32f520) returned 0x0 [0081.268] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.268] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x87\x84", pcbDataBuf=0x32f520) returned 0x0 [0081.269] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.269] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xe8\x31\x51\xff\xff\x59\x8b\x4d\xfc\x5f\x33\xcd\x5e\xe8\x14\x49\xff\xff\x8b\xe5\x5d\x8b\xe3\x5b\xc3\x55\x8b\xec\x51\x51\xdd\x45\x08\xd9\xfc\xdd\x5d\xf8\xdd\x45\xf8\x8b\xe5\x5d\xc3\x55\x8b\xec\x83\xec\x18\xe8\x51\x21\xff\xff\x85\xc0\x74\x57\x68\x7c\x0e\x4a", pcbDataBuf=0x32f520) returned 0x0 [0081.270] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.270] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc2\x75\x31\xf6\x45\x14\x01\x74\x2b\xff\x75\xf0\x8d\x45\xc8\x81\xe1\xff\xff\xff\x7f\xff\x75\xe8\x89\x4d\xf8\x56\x50\xff\x75\xf4\x51\xff\x75\x10\xe8\x1c\xfc\xff\xff\x83\xc4\x1c\x89\x45\xe4\x83\xf8\xff\x75\x32\x8b\x0f\x8b\xc1\xc1\xf8\x05\x83\xe1\x1f\xc1\xe1\x06\x8b\x04\x85\xe0\x39\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.270] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.271] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="9L", pcbDataBuf=0x32f520) returned 0x0 [0081.271] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.271] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="", pcbDataBuf=0x32f520) returned 0x0 [0081.272] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.272] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="u\x11\x83}Ä", pcbDataBuf=0x32f520) returned 0x0 [0081.273] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.273] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x74\x32\x8b\x46\x08\x8b\x4d\x08\x66\x89\x08\xeb\x22\x8b\x45\x08\x66\x89\x45\xfc\x8d\x45\xfc\x6a\x02\x50\x57\xc7\x45\x0c\x02", pcbDataBuf=0x32f520) returned 0x0 [0081.274] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.274] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\xf0\x8b\xc3\xf7\x64\x24\x18\x8b\xc8\x8b\xc6\xf7\x64\x24\x18\x03\xd1\xeb\x47\x8b\xd8\x8b\x4c\x24\x18\x8b\x54\x24\x14\x8b\x44\x24\x10\xd1\xeb\xd1\xd9\xd1\xea\xd1\xd8\x0b\xdb\x75\xf4\xf7\xf1\x8b\xf0\xf7\x64\x24\x1c\x8b\xc8\x8b\x44\x24\x18\xf7\xe6\x03\xd1\x72\x0e\x3b\x54\x24\x14\x77\x08\x72\x0f\x3b\x44\x24\x10\x76\x09\x4e\x2b\x44\x24\x18\x1b\x54\x24\x1c\x33\xdb\x2b\x44\x24\x10\x1b\x54\x24\x14\x4d\x79\x07\xf7\xda\xf7\xd8\x83\xda", pcbDataBuf=0x32f520) returned 0x0 [0081.274] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.274] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x04\xf3\xfe\xff\xc7", pcbDataBuf=0x32f520) returned 0x0 [0081.275] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.275] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xea\xc7\x45\xa8\x05", pcbDataBuf=0x32f520) returned 0x0 [0081.276] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.276] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="f;}\x90\x0f\x87)\x02", pcbDataBuf=0x32f520) returned 0x0 [0081.277] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.277] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x88\x01\x41\x8b\x45\xac\x48\x89\x4d\xa8\x89\x45\xac\x85\xc0\x7e\x0b\x8b\x45\xe8\x89\x45\xbc\xe9\x3e\xff\xff\xff\x8b\x75\x8c\x8b\x7d\x9c\x8a\x41\xff\x83\xe9\x02\x3c\x35\x7c\x45\xeb\x09\x80\x39\x39\x75\x08\xc6\x01\x30\x49\x3b\xcf\x73\xf3\x3b\xcf\x73\x04\x41\x66\xff\x06\xfe\x01\x8b\x45\x8c\x2a\xc8\x80\xe9\x03\x88\x48\x03\x0f\xbe\xc9\x88\x5c\x01\x04\x33\xc0\x40\x8b\x4d\xfc\x5f\x5e\x33\xcd\x5b\xe8\xb7\x21\xff\xff\x8b\xe5\x5d\xc3\x80\x39\x30\x75\x05\x49\x3b\xcf\x73\xf6\x3b\xcf\x73\xcc\x8b\x4d\x8c\x33\xc0\x66\x89\x01\xb8", pcbDataBuf=0x32f520) returned 0x0 [0081.277] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.277] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x81\xfa", pcbDataBuf=0x32f520) returned 0x0 [0081.278] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.278] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xc6\x04\x8b\x06\x85\xc0\x75\xd9\x8b\x0d\xb0\x31\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.279] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.279] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xff\x8d\x78\x01\x57\xe8\x72\xa7\xfe\xff\x8b\xd8\x59\x59\x85\xdb\x74\x15\xff\x75\x08\x57\x53\xe8\x06\x96\xff\xff\x83\xc4\x0c\x85\xc0\x75\x0a\x8b\xc3\xeb\x02\x33\xc0\x5f\x5b\x5d\xc3\x33\xc0\x50\x50\x50\x50\x50\xe8\xfd\xdd\xfe\xff\xcc\x55\x8b\xec\x6a", pcbDataBuf=0x32f520) returned 0x0 [0081.280] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.280] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x83\x3d\xf8\x31\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.280] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.280] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x42\x01\x03\xc1\x2b\xca\x50\x8d\x42\x01\x03\xc7\x2b\xfa\x50\x51\x57\x56\xff\x15\x2c\xf1\x48", pcbDataBuf=0x32f520) returned 0x0 [0081.281] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.281] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x10\x99\x2b\xc2\xd1\xf8\x2b\xc8\x66\x89\x8b\x88", pcbDataBuf=0x32f520) returned 0x0 [0081.282] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.282] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\x08\x8b\x86\xcc\x01", pcbDataBuf=0x32f520) returned 0x0 [0081.283] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.283] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x57\xff\x15\xb8\xf4\x48", pcbDataBuf=0x32f520) returned 0x0 [0081.283] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.283] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x8b\x41\x34\x3b\x07\x75\x11\x80\xb9\x90", pcbDataBuf=0x32f520) returned 0x0 [0081.284] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.284] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\xfc\xff\xff\x75\x24\xff\x75\x20\xff\x75\xfc\xff\x75\xf8\x51\x50\x51\x57\x56\x53\xe8\xbf\xaa\x04", pcbDataBuf=0x32f520) returned 0x0 [0081.285] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.285] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x57\xe8\x69\x4c\xfc\xff\x6a\x01\xff\x75\x1c\xff\x75\x18\x53\x57\xe8\x5a\x4c\xfc\xff\x6a\x01\xff\x75\x24\xff\x75\x20\xe9\x7a\x5f\xfc\xff\xa1\xe0\x57\x4c", pcbDataBuf=0x32f520) returned 0x0 [0081.286] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.286] MsiRecordReadStream (in: hRecord=0x16, iField=0x1, szDataBuf=0x32f538, pcbDataBuf=0x32f520 | out: szDataBuf="\x02", pcbDataBuf=0x32f520) returned 0x0 [0081.286] WriteFile (in: hFile=0x160, lpBuffer=0x32f538*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x32f518, lpOverlapped=0x0 | out: lpBuffer=0x32f538*, lpNumberOfBytesWritten=0x32f518*=0x3e8, lpOverlapped=0x0) returned 1 [0081.774] CloseHandle (hObject=0x160) returned 1 [0081.826] MsiCreateRecord (cParams=0x2) returned 0x19 [0081.826] MsiRecordSetStringW (hRecord=0x19, iField=0x0, szValue="-- CUSTOM ACTION -- Export finished") returned 0x0 [0081.826] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x19) returned 0 [0081.827] MsiCloseHandle (hAny=0x19) returned 0x0 [0081.828] MsiCloseHandle (hAny=0x16) returned 0x0 [0081.829] MsiCloseHandle (hAny=0x10) returned 0x0 [0081.830] MsiCloseHandle (hAny=0x13) returned 0x0 [0081.831] MsiCreateRecord (cParams=0x2) returned 0x1a [0081.832] MsiRecordSetStringW (hRecord=0x1a, iField=0x0, szValue="-- CUSTOM ACTION -- Extract files") returned 0x0 [0081.833] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x1a) returned 0 [0081.835] MsiCloseHandle (hAny=0x1a) returned 0x0 [0081.835] ShellExecuteExW (in: pExecInfo=0x32f94c*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb=0x0, lpFile="expand.exe", lpParameters="-R files.cab -F:* files", lpDirectory="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\", nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x32f94c*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb=0x0, lpFile="expand.exe", lpParameters="-R files.cab -F:* files", lpDirectory="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\", nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x290)) returned 1 [0081.976] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0xffffffff) returned 0x0 [0082.454] CloseHandle (hObject=0x290) returned 1 [0082.455] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="SetupFileName", lpString="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.457] MsiCreateRecord (cParams=0x2) returned 0x1b [0082.458] MsiRecordSetStringW (hRecord=0x1b, iField=0x0, szValue="-- CUSTOM ACTION -- GetParameters: Start.") returned 0x0 [0082.459] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x1b) returned 0 [0082.460] MsiCloseHandle (hAny=0x1b) returned 0x0 [0082.461] MsiCreateRecord (cParams=0x2) returned 0x1c [0082.462] MsiRecordSetStringW (hRecord=0x1c, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.FIXED_INSTALL_ARGUMENTS") returned 0x0 [0082.462] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x1c) returned 0 [0082.464] MsiCloseHandle (hAny=0x1c) returned 0x0 [0082.464] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.FIXED_INSTALL_ARGUMENTS", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f954 | out: szValueBuf="", pcchValueBuf=0x32f954) returned 0xea [0082.466] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.FIXED_INSTALL_ARGUMENTS", szValueBuf=0x17309f0, pcchValueBuf=0x32f954 | out: szValueBuf="", pcchValueBuf=0x32f954) returned 0x0 [0082.467] MsiCreateRecord (cParams=0x2) returned 0x1d [0082.467] MsiRecordSetStringW (hRecord=0x1d, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=") returned 0x0 [0082.468] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x1d) returned 0 [0082.469] MsiCloseHandle (hAny=0x1d) returned 0x0 [0082.470] MsiCreateRecord (cParams=0x2) returned 0x1e [0082.471] MsiRecordSetStringW (hRecord=0x1e, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.VER") returned 0x0 [0082.471] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x1e) returned 0 [0082.473] MsiCloseHandle (hAny=0x1e) returned 0x0 [0082.473] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.VER", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f950 | out: szValueBuf="", pcchValueBuf=0x32f950) returned 0xea [0082.475] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.VER", szValueBuf=0x17309f0, pcchValueBuf=0x32f950 | out: szValueBuf="F", pcchValueBuf=0x32f950) returned 0x0 [0082.476] MsiCreateRecord (cParams=0x2) returned 0x1f [0082.477] MsiRecordSetStringW (hRecord=0x1f, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=F") returned 0x0 [0082.477] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x1f) returned 0 [0082.478] MsiCloseHandle (hAny=0x1f) returned 0x0 [0082.479] MsiCreateRecord (cParams=0x2) returned 0x20 [0082.479] MsiRecordSetStringW (hRecord=0x20, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=UILevel") returned 0x0 [0082.479] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x20) returned 0 [0082.480] MsiCloseHandle (hAny=0x20) returned 0x0 [0082.480] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f94c | out: szValueBuf="", pcchValueBuf=0x32f94c) returned 0xea [0082.480] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x17309f0, pcchValueBuf=0x32f94c | out: szValueBuf="2", pcchValueBuf=0x32f94c) returned 0x0 [0082.480] MsiCreateRecord (cParams=0x2) returned 0x21 [0082.480] MsiRecordSetStringW (hRecord=0x21, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=2") returned 0x0 [0082.480] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x21) returned 0 [0082.481] MsiCloseHandle (hAny=0x21) returned 0x0 [0082.481] MsiCreateRecord (cParams=0x2) returned 0x22 [0082.481] MsiRecordSetStringW (hRecord=0x22, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=WRAPPED_ARGUMENTS") returned 0x0 [0082.481] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x22) returned 0 [0082.482] MsiCloseHandle (hAny=0x22) returned 0x0 [0082.482] MsiGetPropertyW (in: hInstall=0x1, szName="WRAPPED_ARGUMENTS", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f948 | out: szValueBuf="", pcchValueBuf=0x32f948) returned 0xea [0082.482] MsiGetPropertyW (in: hInstall=0x1, szName="WRAPPED_ARGUMENTS", szValueBuf=0x17309f0, pcchValueBuf=0x32f948 | out: szValueBuf="", pcchValueBuf=0x32f948) returned 0x0 [0082.482] MsiCreateRecord (cParams=0x2) returned 0x23 [0082.483] MsiRecordSetStringW (hRecord=0x23, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=") returned 0x0 [0082.483] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x23) returned 0 [0082.483] MsiCloseHandle (hAny=0x23) returned 0x0 [0082.484] MsiCreateRecord (cParams=0x2) returned 0x24 [0082.484] MsiRecordSetStringW (hRecord=0x24, iField=0x0, szValue="-- CUSTOM ACTION -- GetParameters: Done.") returned 0x0 [0082.484] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x24) returned 0 [0082.484] MsiCloseHandle (hAny=0x24) returned 0x0 [0082.485] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="SetupParameters", lpString="", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.486] MsiCreateRecord (cParams=0x2) returned 0x25 [0082.487] MsiRecordSetStringW (hRecord=0x25, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=[SourceDir]") returned 0x0 [0082.487] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x25) returned 0 [0082.488] MsiCloseHandle (hAny=0x25) returned 0x0 [0082.488] MsiGetPropertyW (in: hInstall=0x1, szName="[SourceDir]", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0082.488] MsiGetPropertyW (in: hInstall=0x1, szName="[SourceDir]", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0x0 [0082.488] MsiCreateRecord (cParams=0x2) returned 0x26 [0082.488] MsiRecordSetStringW (hRecord=0x26, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=") returned 0x0 [0082.489] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x26) returned 0 [0082.489] MsiCloseHandle (hAny=0x26) returned 0x0 [0082.489] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="WorkingDir", lpString="", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.491] MsiCreateRecord (cParams=0x2) returned 0x27 [0082.491] MsiRecordSetStringW (hRecord=0x27, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.CURRENTDIR") returned 0x0 [0082.491] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x27) returned 0 [0082.492] MsiCloseHandle (hAny=0x27) returned 0x0 [0082.492] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.CURRENTDIR", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0082.492] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.CURRENTDIR", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="*SOURCEDIR*", pcchValueBuf=0x32f99c) returned 0x0 [0082.493] MsiCreateRecord (cParams=0x2) returned 0x28 [0082.493] MsiRecordSetStringW (hRecord=0x28, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=*SOURCEDIR*") returned 0x0 [0082.493] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x28) returned 0 [0082.494] MsiCloseHandle (hAny=0x28) returned 0x0 [0082.494] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="CurrentDir", lpString="*SOURCEDIR*", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.495] MsiCreateRecord (cParams=0x2) returned 0x29 [0082.495] MsiRecordSetStringW (hRecord=0x29, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=UILevel") returned 0x0 [0082.496] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x29) returned 0 [0082.496] MsiCloseHandle (hAny=0x29) returned 0x0 [0082.496] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0082.496] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="2", pcchValueBuf=0x32f99c) returned 0x0 [0082.497] MsiCreateRecord (cParams=0x2) returned 0x2a [0082.497] MsiRecordSetStringW (hRecord=0x2a, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=2") returned 0x0 [0082.497] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2a) returned 0 [0082.498] MsiCloseHandle (hAny=0x2a) returned 0x0 [0082.498] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="UILevel", lpString="2", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.499] GetCurrentProcess () returned 0xffffffff [0082.499] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x32f998 | out: TokenHandle=0x32f998*=0x290) returned 1 [0082.499] GetTokenInformation (in: TokenHandle=0x290, TokenInformationClass=0x14, TokenInformation=0x32f990, TokenInformationLength=0x4, ReturnLength=0x32f994 | out: TokenInformation=0x32f990, ReturnLength=0x32f994) returned 1 [0082.499] CloseHandle (hObject=0x290) returned 1 [0082.499] MsiCreateRecord (cParams=0x2) returned 0x2b [0082.500] MsiRecordSetStringW (hRecord=0x2b, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=UILevel") returned 0x0 [0082.500] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2b) returned 0 [0082.500] MsiCloseHandle (hAny=0x2b) returned 0x0 [0082.501] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f988 | out: szValueBuf="", pcchValueBuf=0x32f988) returned 0xea [0082.501] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x17309f0, pcchValueBuf=0x32f988 | out: szValueBuf="2", pcchValueBuf=0x32f988) returned 0x0 [0082.501] MsiCreateRecord (cParams=0x2) returned 0x2c [0082.501] MsiRecordSetStringW (hRecord=0x2c, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=2") returned 0x0 [0082.501] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2c) returned 0 [0082.502] MsiCloseHandle (hAny=0x2c) returned 0x0 [0082.502] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="Focus", lpString="no", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.504] MsiCreateRecord (cParams=0x2) returned 0x2d [0082.504] MsiRecordSetStringW (hRecord=0x2d, iField=0x0, szValue="-- CUSTOM ACTION -- SetProperty: Name=BZ.INIFILE") returned 0x0 [0082.504] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2d) returned 0 [0082.504] MsiCloseHandle (hAny=0x2d) returned 0x0 [0082.505] MsiCreateRecord (cParams=0x2) returned 0x2e [0082.505] MsiRecordSetStringW (hRecord=0x2e, iField=0x0, szValue="-- CUSTOM ACTION -- SetProperty: Value=C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 0x0 [0082.505] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2e) returned 0 [0082.506] MsiCloseHandle (hAny=0x2e) returned 0x0 [0082.506] MsiSetPropertyW (hInstall=0x1, szName="BZ.INIFILE", szValue="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 0x0 [0082.506] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="FilesDir", lpString="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.507] MsiCreateRecord (cParams=0x2) returned 0x2f [0082.508] MsiRecordSetStringW (hRecord=0x2f, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_BEFORE_INSTALL_FILE") returned 0x0 [0082.508] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2f) returned 0 [0082.508] MsiCloseHandle (hAny=0x2f) returned 0x0 [0082.508] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_BEFORE_INSTALL_FILE", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0082.509] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_BEFORE_INSTALL_FILE", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0x0 [0082.509] MsiCreateRecord (cParams=0x2) returned 0x30 [0082.509] MsiRecordSetStringW (hRecord=0x30, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=") returned 0x0 [0082.509] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x30) returned 0 [0082.510] MsiCloseHandle (hAny=0x30) returned 0x0 [0082.510] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="RunBeforeInstallFile", lpString="", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.511] MsiCreateRecord (cParams=0x2) returned 0x31 [0082.512] MsiRecordSetStringW (hRecord=0x31, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_BEFORE_INSTALL_PARAMETERS") returned 0x0 [0082.512] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x31) returned 0 [0082.512] MsiCloseHandle (hAny=0x31) returned 0x0 [0082.512] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_BEFORE_INSTALL_PARAMETERS", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0082.513] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_BEFORE_INSTALL_PARAMETERS", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0x0 [0082.513] MsiCreateRecord (cParams=0x2) returned 0x32 [0082.513] MsiRecordSetStringW (hRecord=0x32, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=") returned 0x0 [0082.513] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x32) returned 0 [0082.514] MsiCloseHandle (hAny=0x32) returned 0x0 [0082.514] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="RunBeforeInstallParameters", lpString="", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.516] MsiCreateRecord (cParams=0x2) returned 0x33 [0082.516] MsiRecordSetStringW (hRecord=0x33, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_AFTER_INSTALL_FILE") returned 0x0 [0082.516] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x33) returned 0 [0082.516] MsiCloseHandle (hAny=0x33) returned 0x0 [0082.517] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_AFTER_INSTALL_FILE", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0082.517] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_AFTER_INSTALL_FILE", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0x0 [0082.517] MsiCreateRecord (cParams=0x2) returned 0x34 [0082.517] MsiRecordSetStringW (hRecord=0x34, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=") returned 0x0 [0082.517] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x34) returned 0 [0082.518] MsiCloseHandle (hAny=0x34) returned 0x0 [0082.518] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="RunAfterInstallFile", lpString="", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.520] MsiCreateRecord (cParams=0x2) returned 0x35 [0082.520] MsiRecordSetStringW (hRecord=0x35, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_AFTER_INSTALL_PARAMETERS") returned 0x0 [0082.520] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x35) returned 0 [0082.521] MsiCloseHandle (hAny=0x35) returned 0x0 [0082.521] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_AFTER_INSTALL_PARAMETERS", szValueBuf=0x6c349cfc, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0xea [0082.521] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_AFTER_INSTALL_PARAMETERS", szValueBuf=0x17309f0, pcchValueBuf=0x32f99c | out: szValueBuf="", pcchValueBuf=0x32f99c) returned 0x0 [0082.521] MsiCreateRecord (cParams=0x2) returned 0x36 [0082.521] MsiRecordSetStringW (hRecord=0x36, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=") returned 0x0 [0082.521] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x36) returned 0 [0082.522] MsiCloseHandle (hAny=0x36) returned 0x0 [0082.522] WritePrivateProfileStringW (lpAppName="MSI Wrapper", lpKeyName="RunAfterInstallParameters", lpString="", lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 1 [0082.524] MsiCreateRecord (cParams=0x2) returned 0x37 [0082.524] MsiRecordSetStringW (hRecord=0x37, iField=0x0, szValue="-- CUSTOM ACTION -- InstallPrepareInternal returned successfully") returned 0x0 [0082.524] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x37) returned 0 [0082.525] MsiCloseHandle (hAny=0x37) returned 0x0 [0082.525] MsiCreateRecord (cParams=0x2) returned 0x38 [0082.525] MsiRecordSetStringW (hRecord=0x38, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.INIFILE") returned 0x0 [0082.525] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x38) returned 0 [0082.526] MsiCloseHandle (hAny=0x38) returned 0x0 [0082.526] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.INIFILE", szValueBuf=0x6c349cfc, pcchValueBuf=0x32fa04 | out: szValueBuf="", pcchValueBuf=0x32fa04) returned 0xea [0082.526] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.INIFILE", szValueBuf=0x17309f0, pcchValueBuf=0x32fa04 | out: szValueBuf="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini", pcchValueBuf=0x32fa04) returned 0x0 [0082.526] MsiCreateRecord (cParams=0x2) returned 0x39 [0082.526] MsiRecordSetStringW (hRecord=0x39, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 0x0 [0082.526] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x39) returned 0 [0082.527] MsiCloseHandle (hAny=0x39) returned 0x0 [0082.527] MsiCreateRecord (cParams=0x2) returned 0x3a [0082.547] MsiRecordSetStringW (hRecord=0x3a, iField=0x0, szValue="-- CUSTOM ACTION -- Settings were written to C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini") returned 0x0 [0082.547] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3a) returned 0 [0082.548] MsiCloseHandle (hAny=0x3a) returned 0x0 [0082.548] MsiCreateRecord (cParams=0x2) returned 0x3b [0082.548] MsiRecordSetStringW (hRecord=0x3b, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.WRAPPED_APPID") returned 0x0 [0082.548] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3b) returned 0 [0082.549] MsiCloseHandle (hAny=0x3b) returned 0x0 [0082.549] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.WRAPPED_APPID", szValueBuf=0x6c349cfc, pcchValueBuf=0x32fa00 | out: szValueBuf="", pcchValueBuf=0x32fa00) returned 0xea [0082.549] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.WRAPPED_APPID", szValueBuf=0x17309f0, pcchValueBuf=0x32fa00 | out: szValueBuf="{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}", pcchValueBuf=0x32fa00) returned 0x0 [0082.550] MsiCreateRecord (cParams=0x2) returned 0x3c [0082.550] MsiRecordSetStringW (hRecord=0x3c, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value={F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}") returned 0x0 [0082.550] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3c) returned 0 [0082.550] MsiCloseHandle (hAny=0x3c) returned 0x0 [0082.551] MsiCreateRecord (cParams=0x2) returned 0x3d [0082.551] MsiRecordSetStringW (hRecord=0x3d, iField=0x0, szValue="-- CUSTOM ACTION -- Wrapped application id is {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}") returned 0x0 [0082.551] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3d) returned 0 [0082.552] MsiCloseHandle (hAny=0x3d) returned 0x0 [0082.552] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="SetupFileName", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe") returned 0x5c [0082.553] MsiCreateRecord (cParams=0x2) returned 0x3e [0082.553] MsiRecordSetStringW (hRecord=0x3e, iField=0x0, szValue="-- CUSTOM ACTION -- Setup file name is C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe") returned 0x0 [0082.553] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3e) returned 0 [0082.554] MsiCloseHandle (hAny=0x3e) returned 0x0 [0082.554] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="InstallSuccessCodes", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="0") returned 0x1 [0082.554] MsiCreateRecord (cParams=0x2) returned 0x3f [0082.555] MsiRecordSetStringW (hRecord=0x3f, iField=0x0, szValue="-- CUSTOM ACTION -- Valid exit codes are 0") returned 0x0 [0082.555] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3f) returned 0 [0082.555] MsiCloseHandle (hAny=0x3f) returned 0x0 [0082.556] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="SetupParameters", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="") returned 0x0 [0082.556] MsiCreateRecord (cParams=0x2) returned 0x40 [0082.556] MsiRecordSetStringW (hRecord=0x40, iField=0x0, szValue="-- CUSTOM ACTION -- Setup parameters are ") returned 0x0 [0082.557] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x40) returned 0 [0082.557] MsiCloseHandle (hAny=0x40) returned 0x0 [0082.557] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="WorkingDir", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="") returned 0x0 [0082.558] MsiCreateRecord (cParams=0x2) returned 0x41 [0082.558] MsiRecordSetStringW (hRecord=0x41, iField=0x0, szValue="-- CUSTOM ACTION -- Working dir is ") returned 0x0 [0082.558] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x41) returned 0 [0082.559] MsiCloseHandle (hAny=0x41) returned 0x0 [0082.559] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="CurrentDir", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="*SOURCEDIR*") returned 0xb [0082.560] MsiCreateRecord (cParams=0x2) returned 0x42 [0082.560] MsiRecordSetStringW (hRecord=0x42, iField=0x0, szValue="-- CUSTOM ACTION -- Current dir is *SOURCEDIR*") returned 0x0 [0082.560] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x42) returned 0 [0082.561] MsiCloseHandle (hAny=0x42) returned 0x0 [0082.561] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="Focus", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="no") returned 0x2 [0082.562] MsiCreateRecord (cParams=0x2) returned 0x43 [0082.562] MsiRecordSetStringW (hRecord=0x43, iField=0x0, szValue="-- CUSTOM ACTION -- Focus is no") returned 0x0 [0082.562] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x43) returned 0 [0082.563] MsiCloseHandle (hAny=0x43) returned 0x0 [0082.563] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="ElevationMode", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="") returned 0x0 [0082.563] MsiCreateRecord (cParams=0x2) returned 0x44 [0082.564] MsiRecordSetStringW (hRecord=0x44, iField=0x0, szValue="-- CUSTOM ACTION -- Elevation mode is ") returned 0x0 [0082.564] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x44) returned 0 [0082.564] MsiCloseHandle (hAny=0x44) returned 0x0 [0082.564] MsiCreateRecord (cParams=0x2) returned 0x45 [0082.565] MsiRecordSetStringW (hRecord=0x45, iField=0x0, szValue="-- CUSTOM ACTION -- Debug Here") returned 0x0 [0082.565] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x45) returned 0 [0082.566] MsiCloseHandle (hAny=0x45) returned 0x0 [0082.566] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="RunBeforeInstallFile", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="") returned 0x0 [0082.567] MsiCreateRecord (cParams=0x2) returned 0x46 [0082.567] MsiRecordSetStringW (hRecord=0x46, iField=0x0, szValue="-- CUSTOM ACTION -- Run before install file: ") returned 0x0 [0082.567] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x46) returned 0 [0082.568] MsiCloseHandle (hAny=0x46) returned 0x0 [0082.568] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="RunBeforeInstallParameters", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="") returned 0x0 [0082.568] MsiCreateRecord (cParams=0x2) returned 0x47 [0082.569] MsiRecordSetStringW (hRecord=0x47, iField=0x0, szValue="-- CUSTOM ACTION -- Run before install parameters: ") returned 0x0 [0082.569] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x47) returned 0 [0082.569] MsiCloseHandle (hAny=0x47) returned 0x0 [0082.570] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="RunAfterInstallFile", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="") returned 0x0 [0082.570] MsiCreateRecord (cParams=0x2) returned 0x48 [0082.570] MsiRecordSetStringW (hRecord=0x48, iField=0x0, szValue="-- CUSTOM ACTION -- Run after install file: ") returned 0x0 [0082.570] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x48) returned 0 [0082.571] MsiCloseHandle (hAny=0x48) returned 0x0 [0082.571] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="RunAfterInstallParameters", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="") returned 0x0 [0082.572] MsiCreateRecord (cParams=0x2) returned 0x49 [0082.572] MsiRecordSetStringW (hRecord=0x49, iField=0x0, szValue="-- CUSTOM ACTION -- Run after install parameters: ") returned 0x0 [0082.572] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x49) returned 0 [0082.573] MsiCloseHandle (hAny=0x49) returned 0x0 [0082.573] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="FilesDir", lpDefault="", lpReturnedString=0x32e984, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\") returned 0x51 [0082.574] MsiCreateRecord (cParams=0x2) returned 0x4a [0082.574] MsiRecordSetStringW (hRecord=0x4a, iField=0x0, szValue="-- CUSTOM ACTION -- Unpacked files directory: C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\") returned 0x0 [0082.574] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x4a) returned 0 [0082.575] MsiCloseHandle (hAny=0x4a) returned 0x0 [0082.575] GetPrivateProfileStringW (in: lpAppName="MSI Wrapper", lpKeyName="UILevel", lpDefault="", lpReturnedString=0x32e974, nSize=0x7d0, lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\msiwrapper.ini" | out: lpReturnedString="2") returned 0x1 [0082.576] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x6c34b6fa, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0082.576] MsiCreateRecord (cParams=0x2) returned 0x4b [0082.576] MsiRecordSetStringW (hRecord=0x4b, iField=0x0, szValue="-- CUSTOM ACTION -- Run wrapped setup") returned 0x0 [0082.576] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x4b) returned 0 [0082.576] MsiCloseHandle (hAny=0x4b) returned 0x0 [0082.577] MsiCreateRecord (cParams=0x2) returned 0x4c [0082.577] MsiRecordSetStringW (hRecord=0x4c, iField=0x0, szValue="-- CUSTOM ACTION -- Elevation mode is ") returned 0x0 [0082.577] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x4c) returned 0 [0082.577] MsiCloseHandle (hAny=0x4c) returned 0x0 [0082.578] GetVersionExW (in: lpVersionInformation=0x32f81c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x32f81c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0082.578] MsiCreateRecord (cParams=0x2) returned 0x4d [0082.578] MsiRecordSetStringW (hRecord=0x4d, iField=0x0, szValue="-- CUSTOM ACTION -- OS supports elevation") returned 0x0 [0082.578] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x4d) returned 0 [0082.579] MsiCloseHandle (hAny=0x4d) returned 0x0 [0082.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x6c34b76c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0082.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x6c34b76c, cbMultiByte=-1, lpWideCharStr=0x39f448, cchWideChar=6 | out: lpWideCharStr="alwaysT") returned 0 [0082.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x6c34b774, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0082.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x6c34b774, cbMultiByte=-1, lpWideCharStr=0x378ec8, cchWideChar=14 | out: lpWideCharStr="administrators ") returned 0 [0082.579] MsiCreateRecord (cParams=0x2) returned 0x4e [0082.579] MsiRecordSetStringW (hRecord=0x4e, iField=0x0, szValue="-- CUSTOM ACTION -- Do not elevate executable installer") returned 0x0 [0082.579] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x4e) returned 0 [0082.580] MsiCloseHandle (hAny=0x4e) returned 0x0 [0082.580] ShellExecuteExW (in: pExecInfo=0x32f94c*(cbSize=0x3c, fMask=0x8140, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpParameters="", lpDirectory="", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x32f94c*(cbSize=0x3c, fMask=0x8140, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpParameters="", lpDirectory="", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x2dc)) returned 1 [0082.749] MsiCreateRecord (cParams=0x2) returned 0x4f [0082.750] MsiRecordSetStringW (hRecord=0x4f, iField=0x0, szValue="-- CUSTOM ACTION -- Wait for finish") returned 0x0 [0082.751] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x4f) returned 0 [0082.764] MsiCloseHandle (hAny=0x4f) returned 0x0 [0082.765] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0xffffffff) returned 0x0 [0094.803] GetExitCodeProcess (in: hProcess=0x2dc, lpExitCode=0x32f9a8 | out: lpExitCode=0x32f9a8*=0x0) returned 1 [0094.803] CloseHandle (hObject=0x2dc) returned 1 [0094.803] GetLastError () returned 0x0 [0094.803] SetLastError (dwErrCode=0x0) [0094.803] GetLastError () returned 0x0 [0094.803] SetLastError (dwErrCode=0x0) [0094.803] MsiCreateRecord (cParams=0x2) returned 0x50 [0094.855] MsiRecordSetStringW (hRecord=0x50, iField=0x0, szValue="-- CUSTOM ACTION -- Success running wrapped setup. Exit code 0") returned 0x0 [0094.856] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x50) returned 0 [0095.027] MsiCloseHandle (hAny=0x50) returned 0x0 [0095.028] MsiCreateRecord (cParams=0x2) returned 0x51 [0095.029] MsiRecordSetStringW (hRecord=0x51, iField=0x0, szValue="-- CUSTOM ACTION -- Check exit code mapping") returned 0x0 [0095.030] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x51) returned 0 [0095.086] MsiCloseHandle (hAny=0x51) returned 0x0 [0095.088] GetLastError () returned 0x0 [0095.088] SetLastError (dwErrCode=0x0) [0095.088] GetLastError () returned 0x0 [0095.088] SetLastError (dwErrCode=0x0) [0095.088] MsiCreateRecord (cParams=0x2) returned 0x52 [0095.090] MsiRecordSetStringW (hRecord=0x52, iField=0x0, szValue="-- CUSTOM ACTION -- Exit code 0 is mapped to 0 using the map '0'.") returned 0x0 [0095.092] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x52) returned 0 [0095.099] MsiCloseHandle (hAny=0x52) returned 0x0 [0095.101] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x6c34b6fa, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0095.101] MsiCreateRecord (cParams=0x2) returned 0x53 [0095.102] MsiRecordSetStringW (hRecord=0x53, iField=0x0, szValue="-- CUSTOM ACTION -- InstallFinish1Internal returned successfully") returned 0x0 [0095.103] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x53) returned 0 [0095.105] MsiCloseHandle (hAny=0x53) returned 0x0 [0095.106] MsiCreateRecord (cParams=0x2) returned 0x54 [0095.108] MsiRecordSetStringW (hRecord=0x54, iField=0x0, szValue="-- CUSTOM ACTION -- Detect installation context (per user or per machine)") returned 0x0 [0095.110] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x54) returned 0 [0095.112] MsiCloseHandle (hAny=0x54) returned 0x0 [0095.112] MsiCreateRecord (cParams=0x2) returned 0x55 [0095.113] MsiRecordSetStringW (hRecord=0x55, iField=0x0, szValue="-- CUSTOM ACTION -- Registry key name=SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}") returned 0x0 [0095.114] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x55) returned 0 [0095.116] MsiCloseHandle (hAny=0x55) returned 0x0 [0095.117] MsiCreateRecord (cParams=0x2) returned 0x56 [0095.118] MsiRecordSetStringW (hRecord=0x56, iField=0x0, szValue="-- CUSTOM ACTION -- ReadRegStr: Key=SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}, ValueName=DisplayName, 32 bit") returned 0x0 [0095.118] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x56) returned 0 [0095.120] MsiCloseHandle (hAny=0x56) returned 0x0 [0095.121] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}", ulOptions=0x0, samDesired=0x20219, phkResult=0x32d294 | out: phkResult=0x32d294*=0x0) returned 0x2 [0095.121] MsiCreateRecord (cParams=0x2) returned 0x57 [0095.122] MsiRecordSetStringW (hRecord=0x57, iField=0x0, szValue="-- CUSTOM ACTION -- ReadRegStr: Unable to open key.") returned 0x0 [0095.123] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x57) returned 0 [0095.125] MsiCloseHandle (hAny=0x57) returned 0x0 [0095.125] MsiCreateRecord (cParams=0x2) returned 0x58 [0095.126] MsiRecordSetStringW (hRecord=0x58, iField=0x0, szValue="-- CUSTOM ACTION -- ReadRegStr: Key=SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}, ValueName=DisplayName, 64 bit") returned 0x0 [0095.127] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x58) returned 0 [0095.129] MsiCloseHandle (hAny=0x58) returned 0x0 [0095.129] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}", ulOptions=0x0, samDesired=0x20119, phkResult=0x32d294 | out: phkResult=0x32d294*=0x0) returned 0x2 [0095.129] MsiCreateRecord (cParams=0x2) returned 0x59 [0095.130] MsiRecordSetStringW (hRecord=0x59, iField=0x0, szValue="-- CUSTOM ACTION -- ReadRegStr: Unable to open key.") returned 0x0 [0095.131] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x59) returned 0 [0095.132] MsiCloseHandle (hAny=0x59) returned 0x0 [0095.133] MsiCreateRecord (cParams=0x2) returned 0x5a [0095.167] MsiRecordSetStringW (hRecord=0x5a, iField=0x0, szValue="-- CUSTOM ACTION -- ReadRegStr: Key=SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}, ValueName=DisplayName, default") returned 0x0 [0095.169] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x5a) returned 0 [0095.201] MsiCloseHandle (hAny=0x5a) returned 0x0 [0095.207] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}", ulOptions=0x0, samDesired=0x20019, phkResult=0x32d294 | out: phkResult=0x32d294*=0x0) returned 0x2 [0095.207] MsiCreateRecord (cParams=0x2) returned 0x5b [0095.208] MsiRecordSetStringW (hRecord=0x5b, iField=0x0, szValue="-- CUSTOM ACTION -- ReadRegStr: Unable to open key.") returned 0x0 [0095.209] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x5b) returned 0 [0095.215] MsiCloseHandle (hAny=0x5b) returned 0x0 [0095.216] MsiCreateRecord (cParams=0x2) returned 0x5c [0095.217] MsiRecordSetStringW (hRecord=0x5c, iField=0x0, szValue="-- CUSTOM ACTION -- Wrapped setup was installed Per Machine") returned 0x0 [0095.218] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x5c) returned 0 [0095.220] MsiCloseHandle (hAny=0x5c) returned 0x0 [0095.220] MsiCreateRecord (cParams=0x2) returned 0x5d [0095.221] MsiRecordSetStringW (hRecord=0x5d, iField=0x0, szValue="-- CUSTOM ACTION -- SetProperty: Name=ALLUSERS") returned 0x0 [0095.222] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x5d) returned 0 [0095.223] MsiCloseHandle (hAny=0x5d) returned 0x0 [0095.224] MsiCreateRecord (cParams=0x2) returned 0x5e [0095.225] MsiRecordSetStringW (hRecord=0x5e, iField=0x0, szValue="-- CUSTOM ACTION -- SetProperty: Value=1") returned 0x0 [0095.226] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x5e) returned 0 [0095.227] MsiCloseHandle (hAny=0x5e) returned 0x0 [0095.228] MsiSetPropertyW (hInstall=0x1, szName="ALLUSERS", szValue="1") returned 0x0 Thread: id = 148 os_tid = 0x3b0 [0081.839] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0081.839] GetProcAddress (hModule=0x777b0000, lpProcName="DecodePointer") returned 0x7793cd10 [0081.839] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0081.839] GetProcAddress (hModule=0x777b0000, lpProcName="DecodePointer") returned 0x7793cd10 [0081.840] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0081.840] GetProcAddress (hModule=0x777b0000, lpProcName="EncodePointer") returned 0x7793a295 [0081.840] GetProcAddress (hModule=0x777b0000, lpProcName="DecodePointer") returned 0x7793cd10 [0081.840] GetCurrentThreadId () returned 0x3b0 [0081.976] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0081.976] GetProcAddress (hModule=0x777b0000, lpProcName="DecodePointer") returned 0x7793cd10 Thread: id = 149 os_tid = 0x164 [0081.960] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0081.960] GetProcAddress (hModule=0x777b0000, lpProcName="DecodePointer") returned 0x7793cd10 [0081.960] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0081.960] GetProcAddress (hModule=0x777b0000, lpProcName="DecodePointer") returned 0x7793cd10 [0081.960] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0081.960] GetProcAddress (hModule=0x777b0000, lpProcName="EncodePointer") returned 0x7793a295 [0081.960] GetProcAddress (hModule=0x777b0000, lpProcName="DecodePointer") returned 0x7793cd10 [0081.960] GetCurrentThreadId () returned 0x164 Thread: id = 150 os_tid = 0x824 [0081.969] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0081.970] GetProcAddress (hModule=0x777b0000, lpProcName="DecodePointer") returned 0x7793cd10 [0081.970] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0081.970] GetProcAddress (hModule=0x777b0000, lpProcName="DecodePointer") returned 0x7793cd10 [0081.970] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0081.970] GetProcAddress (hModule=0x777b0000, lpProcName="EncodePointer") returned 0x7793a295 [0081.971] GetProcAddress (hModule=0x777b0000, lpProcName="DecodePointer") returned 0x7793cd10 [0081.971] GetCurrentThreadId () returned 0x824 Process: id = "8" image_name = "expand.exe" filename = "c:\\windows\\system32\\expand.exe" page_root = "0x7f1f6680" os_pid = "0x844" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x598" cmd_line = "\"C:\\Windows\\System32\\expand.exe\" -R files.cab -F:* files" cur_dir = "C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1556 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1557 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1558 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1559 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1560 start_va = 0xfd0000 end_va = 0xfdffff entry_point = 0xfd0000 region_type = mapped_file name = "expand.exe" filename = "\\Windows\\System32\\expand.exe" (normalized: "c:\\windows\\system32\\expand.exe") Region: id = 1561 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1562 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1563 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 1564 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 1565 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 1566 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1567 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1568 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1569 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 1570 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1571 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1572 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 1573 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1574 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1575 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1576 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1577 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1578 start_va = 0x73b50000 end_va = 0x73b64fff entry_point = 0x73b50000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1579 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1580 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1581 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1582 start_va = 0x120000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 1583 start_va = 0x210000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 1584 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1585 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1586 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1587 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1588 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0xe0000 region_type = mapped_file name = "expand.exe.mui" filename = "\\Windows\\System32\\en-US\\expand.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\expand.exe.mui") Region: id = 1589 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1590 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1591 start_va = 0x460000 end_va = 0x560fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 1592 start_va = 0xfe0000 end_va = 0x1bdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fe0000" filename = "" Region: id = 1593 start_va = 0x6b5b0000 end_va = 0x6b5f1fff entry_point = 0x6b5b0000 region_type = mapped_file name = "dpx.dll" filename = "\\Windows\\System32\\dpx.dll" (normalized: "c:\\windows\\system32\\dpx.dll") Region: id = 1594 start_va = 0x71c80000 end_va = 0x71cb1fff entry_point = 0x71c80000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1595 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1596 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1597 start_va = 0x570000 end_va = 0x6fffff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 1598 start_va = 0x6f2d0000 end_va = 0x6f3bafff entry_point = 0x6f2d0000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 1599 start_va = 0x570000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 1600 start_va = 0x6f0000 end_va = 0x6fffff entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1601 start_va = 0x700000 end_va = 0x85ffff entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1602 start_va = 0x110000 end_va = 0x117fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 1603 start_va = 0x860000 end_va = 0xb2efff entry_point = 0x860000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1604 start_va = 0x6a0000 end_va = 0x6dffff entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 1605 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1606 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Thread: id = 151 os_tid = 0x83c [0082.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fb88 | out: lpSystemTimeAsFileTime=0x20fb88*(dwLowDateTime=0x1f8d5030, dwHighDateTime=0x1d4b1a5)) [0082.141] GetCurrentProcessId () returned 0x844 [0082.141] GetCurrentThreadId () returned 0x83c [0082.141] GetTickCount () returned 0xa6d5d8 [0082.141] QueryPerformanceCounter (in: lpPerformanceCount=0x20fb80 | out: lpPerformanceCount=0x20fb80*=1820033900000) returned 1 [0082.142] GetModuleHandleA (lpModuleName=0x0) returned 0xfd0000 [0082.142] __set_app_type (_Type=0x1) [0082.142] __p__fmode () returned 0x76cf31f4 [0082.142] __p__commode () returned 0x76cf31fc [0082.142] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfd6ef9) returned 0x0 [0082.142] __getmainargs (in: _Argc=0xfdc358, _Argv=0xfdc360, _Env=0xfdc35c, _DoWildCard=1, _StartInfo=0xfdc36c | out: _Argc=0xfdc358, _Argv=0xfdc360, _Env=0xfdc35c) returned 0 [0082.144] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0082.144] SetThreadUILanguage (LangId=0x0) returned 0x409 [0082.144] _wsetlocale (category=1, locale=".OCP") returned="English_United States.437" [0082.145] _wsetlocale (category=3, locale=".OCP") returned="English_United States.437" [0082.145] _wsetlocale (category=4, locale=".OCP") returned="English_United States.437" [0082.146] _wsetlocale (category=5, locale=".OCP") returned="English_United States.437" [0082.146] GetConsoleOutputCP () returned 0x1b5 [0082.146] _wsetlocale (category=2, locale=".437") returned="English_United States.437" [0082.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfd1284, cbMultiByte=-1, lpWideCharStr=0x20f7f0, cchWideChar=260 | out: lpWideCharStr="Expand.exe") returned 11 [0082.146] GetVersionExW (in: lpVersionInformation=0x20f280*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x20f280*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0082.146] LoadLibraryExW (lpLibFileName="Expand.exe", hFile=0x0, dwFlags=0x22) returned 0xfd0000 [0082.146] LoadStringA (in: hInstance=0xfd0000, uID=0xa, lpBuffer=0xfdc700, cchBufferMax=2048 | out: lpBuffer="Microsoft (R) File Expansion Utility Version %s\nCopyright (c) Microsoft Corporation. All rights reserved.\n\n") returned 0x6c [0082.147] CharToOemA (in: pSrc="Microsoft (R) File Expansion Utility Version %s\nCopyright (c) Microsoft Corporation. All rights reserved.\n\n", pDst=0xfdc700 | out: pDst="Microsoft (R) File Expansion Utility Version %s\nCopyright (c) Microsoft Corporation. All rights reserved.\n\n") returned 1 [0082.147] printf (_Format="Microsoft (R) File Expansion Utility Version %s\nCopyright (c) Microsoft Corporation. All rights reserved.\n\n") returned 120 [0082.162] GetFileAttributesA (lpFileName="files.cab" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files.cab")) returned 0x2020 [0082.162] GetFileAttributesA (lpFileName="files" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files")) returned 0x2010 [0082.162] GetFileAttributesA (lpFileName="files" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files")) returned 0x2010 [0082.162] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x3710e8 [0082.163] FDICreate () returned 0x3821e0 [0082.163] LocalAlloc (uFlags=0x0, uBytes=0x804) returned 0x3821e0 [0082.163] GetFileAttributesA (lpFileName="files.cab" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files.cab")) returned 0x2020 [0082.164] lstrlenA (lpString="files") returned 5 [0082.164] _lopen (lpPathName="files.cab" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files.cab"), iReadWrite=32) returned 0x50 [0082.164] FDIIsCabinet () returned 0x1 [0082.164] _hread (in: hFile=0x50, lpBuffer=0x20f9a4, lBytes=36 | out: lpBuffer=0x20f9a4*) returned 36 [0082.165] _lclose (hFile=0x50) returned 0x0 [0082.165] GetACP () returned 0x4e4 [0082.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x1210d5, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0082.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x1210d5, cbMultiByte=9, lpWideCharStr=0x122518, cchWideChar=9 | out: lpWideCharStr="files.cab\x12∠\x12＃⟐駂") returned 9 [0082.165] GetACP () returned 0x4e4 [0082.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x1210e6, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0082.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x1210e6, cbMultiByte=5, lpWideCharStr=0x12d9b8, cchWideChar=5 | out: lpWideCharStr="files") returned 5 [0082.165] GetFileAttributesW (lpFileName="files" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files")) returned 0x2010 [0082.165] LoadLibraryA (lpLibFileName="dpx.dll") returned 0x6b5b0000 [0082.280] GetProcAddress (hModule=0x6b5b0000, lpProcName="DpxNewJob") returned 0x6b5b3302 [0082.280] DpxNewJob () returned 0x0 [0082.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpEng.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0082.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsMpEng.exe", cchWideChar=11, lpMultiByteStr=0x571e60, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsMpEng.exeÿÿÿÿÿJÜ\x1d5", lpUsedDefaultChar=0x0) returned 11 [0082.304] GetFullPathNameW (in: lpFileName="files.cab", nBufferLength=0x104, lpBuffer=0x20f4c4, lpFilePart=0x20f4c0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files.cab", lpFilePart=0x20f4c0*="files.cab") returned 0x54 [0082.304] GetFullPathNameW (in: lpFileName="files\\MsMpEng.exe", nBufferLength=0x104, lpBuffer=0x20f6cc, lpFilePart=0x20f4c0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x20f4c0*="MsMpEng.exe") returned 0x5c [0082.304] lstrcmpiW (lpString1="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files.cab", lpString2="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe") returned -1 [0082.305] LoadStringW (in: hInstance=0xfd0000, uID=0x26, lpBuffer=0xfdb350, cchBufferMax=2048 | out: lpBuffer="Adding %s to Extraction Queue\n") returned 0x1e [0082.305] GetConsoleOutputCP () returned 0x1b5 [0082.305] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Adding files\\MsMpEng.exe to Extraction Queue\n", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0082.305] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Adding files\\MsMpEng.exe to Extraction Queue\n", cchWideChar=45, lpMultiByteStr=0x573d28, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adding files\\MsMpEng.exe to Extraction Queue\n", lpUsedDefaultChar=0x0) returned 45 [0082.305] printf (_Format="%s") returned 45 [0082.311] fflush (in: _File=0x0 | out: _File=0x0) returned 0 [0082.311] LoadStringW (in: hInstance=0xfd0000, uID=0x24, lpBuffer=0xfdb350, cchBufferMax=2048 | out: lpBuffer="\nExpanding Files ....\n") returned 0x16 [0082.311] GetConsoleOutputCP () returned 0x1b5 [0082.311] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\nExpanding Files ....\n", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0082.311] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\nExpanding Files ....\n", cchWideChar=22, lpMultiByteStr=0x570a40, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\nExpanding Files ....\n", lpUsedDefaultChar=0x0) returned 22 [0082.311] printf (_Format="%s") returned 22 [0082.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xfd5a46, lpParameter=0x570770, dwCreationFlags=0x0, lpThreadId=0x20f97c | out: lpThreadId=0x20f97c*=0x214) returned 0x5c [0082.314] WaitForSingleObject (hHandle=0x5c, dwMilliseconds=0x3e8) returned 0x0 [0082.432] CloseHandle (hObject=0x5c) returned 1 [0082.432] LoadStringW (in: hInstance=0xfd0000, uID=0x25, lpBuffer=0xfdb350, cchBufferMax=2048 | out: lpBuffer="\nExpanding Files Complete ...") returned 0x1d [0082.432] GetConsoleOutputCP () returned 0x1b5 [0082.432] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\nExpanding Files Complete ...", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0082.432] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\nExpanding Files Complete ...", cchWideChar=29, lpMultiByteStr=0x572b90, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\nExpanding Files Complete ...", lpUsedDefaultChar=0x0) returned 29 [0082.432] printf (_Format="%s") returned 29 [0082.436] printf (_Format="\n") returned 1 [0082.436] LocalFree (hMem=0x3710e8) returned 0x0 [0082.436] FDIDestroy () returned 0x1 [0082.436] LocalFree (hMem=0x3821e0) returned 0x0 [0082.436] FreeLibrary (hLibModule=0xfd0000) returned 1 [0082.436] exit (_Code=0) Thread: id = 152 os_tid = 0x214 Process: id = "9" image_name = "msmpeng.exe" filename = "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe" page_root = "0x7f1f6680" os_pid = "0x30c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x598" cmd_line = "\"C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1677 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1678 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1679 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1680 start_va = 0x230000 end_va = 0x4fdfff entry_point = 0x230000 region_type = mapped_file name = "msmpeng.exe" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe") Region: id = 1681 start_va = 0x530000 end_va = 0x92ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 1682 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1683 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1684 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 1685 start_va = 0x7ffd5000 end_va = 0x7ffd5fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 1686 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 1687 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1688 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1689 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1690 start_va = 0x960000 end_va = 0xd5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 1691 start_va = 0x6d030000 end_va = 0x6d036fff entry_point = 0x6d030000 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 1692 start_va = 0x70e70000 end_va = 0x70ea1fff entry_point = 0x70e70000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 1693 start_va = 0x724b0000 end_va = 0x724c1fff entry_point = 0x724b0000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1694 start_va = 0x74060000 end_va = 0x7409ffff entry_point = 0x74060000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1695 start_va = 0x74420000 end_va = 0x74426fff entry_point = 0x74420000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1696 start_va = 0x74430000 end_va = 0x7444bfff entry_point = 0x74430000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1697 start_va = 0x74a10000 end_va = 0x74badfff entry_point = 0x74a10000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 1698 start_va = 0x74f80000 end_va = 0x74f88fff entry_point = 0x74f80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1699 start_va = 0x750e0000 end_va = 0x750f6fff entry_point = 0x750e0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1700 start_va = 0x75a30000 end_va = 0x75a3afff entry_point = 0x75a30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1701 start_va = 0x75aa0000 end_va = 0x75aabfff entry_point = 0x75aa0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1702 start_va = 0x75ab0000 end_va = 0x75bccfff entry_point = 0x75ab0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1703 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1704 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1705 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1706 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1707 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1708 start_va = 0x75f10000 end_va = 0x76b59fff entry_point = 0x75f10000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1709 start_va = 0x76b60000 end_va = 0x76b94fff entry_point = 0x76b60000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1710 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1711 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1712 start_va = 0x76d60000 end_va = 0x76e95fff entry_point = 0x76d60000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 1713 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1714 start_va = 0x77030000 end_va = 0x77124fff entry_point = 0x77030000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1715 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1716 start_va = 0x771d0000 end_va = 0x77226fff entry_point = 0x771d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1717 start_va = 0x77230000 end_va = 0x772aafff entry_point = 0x77230000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 1718 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1719 start_va = 0x775b0000 end_va = 0x777aafff entry_point = 0x775b0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1720 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1721 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1722 start_va = 0x77a30000 end_va = 0x77a34fff entry_point = 0x77a30000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1723 start_va = 0x77b00000 end_va = 0x77b05fff entry_point = 0x77b00000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1724 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 1725 start_va = 0xe0000 end_va = 0x1a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1726 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1727 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1728 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1729 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1730 start_va = 0x1c0000 end_va = 0x1c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1731 start_va = 0xd60000 end_va = 0xe60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d60000" filename = "" Region: id = 1732 start_va = 0xe70000 end_va = 0x1a6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e70000" filename = "" Region: id = 1733 start_va = 0x1c20000 end_va = 0x1c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c20000" filename = "" Region: id = 1734 start_va = 0x1d0000 end_va = 0x22bfff entry_point = 0x1d0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1735 start_va = 0x1d0000 end_va = 0x22bfff entry_point = 0x1d0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1736 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1737 start_va = 0x1a70000 end_va = 0x1b4efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001a70000" filename = "" Region: id = 1738 start_va = 0x1b50000 end_va = 0x1bcffff entry_point = 0x0 region_type = private name = "private_0x0000000001b50000" filename = "" Region: id = 1739 start_va = 0x1c60000 end_va = 0x1d08fff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 1740 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1741 start_va = 0x73d20000 end_va = 0x73d32fff entry_point = 0x73d20000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1742 start_va = 0x1c60000 end_va = 0x1f2efff entry_point = 0x1c60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1743 start_va = 0x1f30000 end_va = 0x212ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 1744 start_va = 0x75960000 end_va = 0x7597afff entry_point = 0x75960000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1745 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1746 start_va = 0x1f30000 end_va = 0x202ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 1747 start_va = 0x20f0000 end_va = 0x212ffff entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 1748 start_va = 0x2030000 end_va = 0x20d0fff entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 1749 start_va = 0x2130000 end_va = 0x21d0fff entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 1750 start_va = 0x23f0000 end_va = 0x2531fff entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 1751 start_va = 0x75500000 end_va = 0x75515fff entry_point = 0x75500000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1752 start_va = 0x1e0000 end_va = 0x21bfff entry_point = 0x1e0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1753 start_va = 0x1e0000 end_va = 0x21bfff entry_point = 0x1e0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1754 start_va = 0x1e0000 end_va = 0x21bfff entry_point = 0x1e0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1755 start_va = 0x1e0000 end_va = 0x21bfff entry_point = 0x1e0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1756 start_va = 0x1e0000 end_va = 0x21bfff entry_point = 0x1e0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1757 start_va = 0x752a0000 end_va = 0x752dafff entry_point = 0x752a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1758 start_va = 0x21e0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 1759 start_va = 0x1e0000 end_va = 0x1e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1760 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1761 start_va = 0x2520000 end_va = 0x265dfff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 1762 start_va = 0x2710000 end_va = 0x2b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 1763 start_va = 0x748d0000 end_va = 0x749c4fff entry_point = 0x748d0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1764 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1765 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 1766 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 1767 start_va = 0x748a0000 end_va = 0x748c0fff entry_point = 0x748a0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1768 start_va = 0x77890000 end_va = 0x778d4fff entry_point = 0x77890000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1769 start_va = 0x210000 end_va = 0x213fff entry_point = 0x210000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1770 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1771 start_va = 0x500000 end_va = 0x51ffff entry_point = 0x500000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000010.db" filename = "\\Users\\JPenUM\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000010.db" (normalized: "c:\\users\\jpenum\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000010.db") Region: id = 1772 start_va = 0x520000 end_va = 0x523fff entry_point = 0x520000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1773 start_va = 0x930000 end_va = 0x95ffff entry_point = 0x930000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db") Region: id = 1774 start_va = 0x2030000 end_va = 0x2095fff entry_point = 0x2030000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1775 start_va = 0x2ba0000 end_va = 0x2f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 1776 start_va = 0x75c00000 end_va = 0x75c11fff entry_point = 0x75c00000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1777 start_va = 0x75c70000 end_va = 0x75c96fff entry_point = 0x75c70000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1778 start_va = 0x77410000 end_va = 0x775acfff entry_point = 0x77410000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1779 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 1780 start_va = 0x1bd0000 end_va = 0x1bd6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001bd0000" filename = "" Region: id = 1781 start_va = 0x1be0000 end_va = 0x1be1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001be0000" filename = "" Region: id = 1782 start_va = 0x2fa0000 end_va = 0x3392fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002fa0000" filename = "" Region: id = 1783 start_va = 0x70420000 end_va = 0x7044dfff entry_point = 0x70420000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 1784 start_va = 0x70f00000 end_va = 0x70f4bfff entry_point = 0x70f00000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1785 start_va = 0x1bf0000 end_va = 0x1bf1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001bf0000" filename = "" Region: id = 1786 start_va = 0x62c00000 end_va = 0x62dc2fff entry_point = 0x62c00000 region_type = mapped_file name = "d3d9.dll" filename = "\\Windows\\System32\\d3d9.dll" (normalized: "c:\\windows\\system32\\d3d9.dll") Region: id = 1787 start_va = 0x6b490000 end_va = 0x6b5f5fff entry_point = 0x6b490000 region_type = mapped_file name = "photoviewer.dll" filename = "\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll") Region: id = 1788 start_va = 0x6da80000 end_va = 0x6dabbfff entry_point = 0x6da80000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 1789 start_va = 0x73850000 end_va = 0x739dffff entry_point = 0x73850000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 1790 start_va = 0x73c20000 end_va = 0x73d1afff entry_point = 0x73c20000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 1791 start_va = 0x73de0000 end_va = 0x73de5fff entry_point = 0x73de0000 region_type = mapped_file name = "d3d8thk.dll" filename = "\\Windows\\System32\\d3d8thk.dll" (normalized: "c:\\windows\\system32\\d3d8thk.dll") Region: id = 1792 start_va = 0x744c0000 end_va = 0x744ccfff entry_point = 0x744c0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1793 start_va = 0x744d0000 end_va = 0x744d9fff entry_point = 0x744d0000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1794 start_va = 0x1c00000 end_va = 0x1c00fff entry_point = 0x1c00000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 1795 start_va = 0x24e0000 end_va = 0x24effff entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 1796 start_va = 0x73dd0000 end_va = 0x73ddbfff entry_point = 0x73dd0000 region_type = mapped_file name = "photobase.dll" filename = "\\Program Files\\Windows Photo Viewer\\PhotoBase.dll" (normalized: "c:\\program files\\windows photo viewer\\photobase.dll") Region: id = 1797 start_va = 0x3450000 end_va = 0x384ffff entry_point = 0x0 region_type = private name = "private_0x0000000003450000" filename = "" Region: id = 1798 start_va = 0x3890000 end_va = 0x3c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003890000" filename = "" Region: id = 1799 start_va = 0x75a20000 end_va = 0x75a2dfff entry_point = 0x75a20000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1800 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 1801 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 1875 start_va = 0x3e20000 end_va = 0x421ffff entry_point = 0x0 region_type = private name = "private_0x0000000003e20000" filename = "" Region: id = 1876 start_va = 0x6d8e0000 end_va = 0x6d90afff entry_point = 0x6d8e0000 region_type = mapped_file name = "ieproxy.dll" filename = "\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll") Region: id = 1877 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 1957 start_va = 0x1c10000 end_va = 0x1c11fff entry_point = 0x0 region_type = private name = "private_0x0000000001c10000" filename = "" Region: id = 1958 start_va = 0x1c00000 end_va = 0x1c00fff entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 1959 start_va = 0x2130000 end_va = 0x21d0fff entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 1960 start_va = 0x23e0000 end_va = 0x2435fff entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 2242 start_va = 0x2130000 end_va = 0x21b0fff entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 2247 start_va = 0x2570000 end_va = 0x296ffff entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 2248 start_va = 0x6da80000 end_va = 0x6dabbfff entry_point = 0x6da80000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 2249 start_va = 0x6dac0000 end_va = 0x6e53ffff entry_point = 0x6dac0000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 2250 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 2272 start_va = 0x1c00000 end_va = 0x1c00fff entry_point = 0x1c00000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 2273 start_va = 0x20a0000 end_va = 0x20a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020a0000" filename = "" Region: id = 2274 start_va = 0x20b0000 end_va = 0x20b0fff entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 2275 start_va = 0x20c0000 end_va = 0x20c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020c0000" filename = "" Region: id = 2276 start_va = 0x20d0000 end_va = 0x20d3fff entry_point = 0x20d0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2277 start_va = 0x20e0000 end_va = 0x20e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020e0000" filename = "" Thread: id = 153 os_tid = 0x2b4 [0082.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x92f8c8 | out: lpSystemTimeAsFileTime=0x92f8c8*(dwLowDateTime=0x1fea25d0, dwHighDateTime=0x1d4b1a5)) [0082.826] GetCurrentThreadId () returned 0x2b4 [0082.826] GetCurrentProcessId () returned 0x30c [0082.826] QueryPerformanceCounter (in: lpPerformanceCount=0x92f8c0 | out: lpPerformanceCount=0x92f8c0*=1820102400000) returned 1 [0082.827] GetStartupInfoW (in: lpStartupInfo=0x92f858 | out: lpStartupInfo=0x92f858*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x77926164, hStdError=0x77966ed5)) [0082.828] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x777b0000 [0082.828] GetProcAddress (hModule=0x777b0000, lpProcName="FlsAlloc") returned 0x7780418d [0082.828] GetProcAddress (hModule=0x777b0000, lpProcName="FlsFree") returned 0x77801f61 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="FlsGetValue") returned 0x77801e16 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="FlsSetValue") returned 0x778076e6 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="InitializeCriticalSectionEx") returned 0x77803879 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="CreateEventExW") returned 0x777b24d8 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="CreateSemaphoreExW") returned 0x777e2111 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="SetThreadStackGuarantee") returned 0x777f2510 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="CreateThreadpoolTimer") returned 0x777eb009 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="SetThreadpoolTimer") returned 0x779089be [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x778fc02a [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="CloseThreadpoolTimer") returned 0x778fc0d2 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="CreateThreadpoolWait") returned 0x777e3f78 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="SetThreadpoolWait") returned 0x77908bfb [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="CloseThreadpoolWait") returned 0x778fb567 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="FlushProcessWriteBuffers") returned 0x77925998 [0082.829] GetProcAddress (hModule=0x777b0000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x778f2251 [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="GetCurrentProcessorNumber") returned 0x778f28f6 [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="GetLogicalProcessorInformation") returned 0x777e2004 [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="CreateSymbolicLinkW") returned 0x77839aa9 [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="EnumSystemLocalesEx") returned 0x7783f3cf [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="CompareStringEx") returned 0x7780ebc6 [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="GetDateFormatEx") returned 0x7784f29f [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="GetLocaleInfoEx") returned 0x777e53a5 [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="GetTimeFormatEx") returned 0x7784f21a [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="GetUserDefaultLocaleName") returned 0x7783f70b [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="IsValidLocaleName") returned 0x7783f71b [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="LCMapStringEx") returned 0x7783f72b [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="GetCurrentPackageId") returned 0x0 [0082.830] GetProcAddress (hModule=0x777b0000, lpProcName="GetTickCount64") returned 0x777eeb4e [0082.831] GetProcAddress (hModule=0x777b0000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0082.831] GetProcAddress (hModule=0x777b0000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0082.831] GetCurrentThreadId () returned 0x2b4 [0082.832] GetStartupInfoW (in: lpStartupInfo=0x92f828 | out: lpStartupInfo=0x92f828*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x259c4d, hStdOutput=0xd8b00c36, hStdError=0x0)) [0082.832] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0082.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0082.832] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0082.832] GetCommandLineW () returned="\"C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe\" " [0082.832] GetEnvironmentStringsW () returned 0x982098* [0082.832] FreeEnvironmentStringsW (penv=0x982098) returned 1 [0082.832] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2f3ba8, nSize=0x104 | out: lpFilename="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe")) returned 0x5c [0082.835] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0082.835] GetLastError () returned 0x0 [0082.835] SetLastError (dwErrCode=0x0) [0082.835] GetLastError () returned 0x0 [0082.835] SetLastError (dwErrCode=0x0) [0082.835] GetLastError () returned 0x0 [0082.835] SetLastError (dwErrCode=0x0) [0082.835] GetACP () returned 0x4e4 [0082.835] GetLastError () returned 0x0 [0082.835] SetLastError (dwErrCode=0x0) [0082.835] IsValidCodePage (CodePage=0x4e4) returned 1 [0082.835] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x92f81c | out: lpCPInfo=0x92f81c) returned 1 [0082.835] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x92f2e4 | out: lpCPInfo=0x92f2e4) returned 1 [0082.835] GetLastError () returned 0x0 [0082.835] SetLastError (dwErrCode=0x0) [0082.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x92f6f8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0082.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x92f6f8, cbMultiByte=256, lpWideCharStr=0x92f068, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0082.835] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x92f2f8 | out: lpCharType=0x92f2f8) returned 1 [0082.836] GetLastError () returned 0x0 [0082.836] SetLastError (dwErrCode=0x0) [0082.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x92f6f8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0082.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x92f6f8, cbMultiByte=256, lpWideCharStr=0x92f038, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0082.836] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0082.836] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x92ee28, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0082.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x92f5f8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x46\x03\xb0\xd8\x34\xf8\x92", lpUsedDefaultChar=0x0) returned 256 [0082.836] GetLastError () returned 0x0 [0082.836] SetLastError (dwErrCode=0x0) [0082.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x92f6f8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0082.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x92f6f8, cbMultiByte=256, lpWideCharStr=0x92f048, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0082.836] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0082.836] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x92ee38, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0082.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x92f4f8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x46\x03\xb0\xd8\x34\xf8\x92", lpUsedDefaultChar=0x0) returned 256 [0082.836] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0082.836] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x264c4c) returned 0x0 [0082.837] GetVersionExW (in: lpVersionInformation=0x92f710*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x370033, dwMinorVersion=0x5c0037, dwBuildNumber=0x690066, dwPlatformId=0x980014, szCSDVersion="\x04") | out: lpVersionInformation=0x92f710*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0082.838] GetCurrentProcess () returned 0xffffffff [0082.838] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x92f860 | out: Wow64Process=0x92f860) returned 1 [0082.838] GetSystemInfo (in: lpSystemInfo=0x92f82c | out: lpSystemInfo=0x92f82c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4f01)) [0082.839] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0082.839] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0082.839] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0082.840] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0082.840] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0082.840] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0082.840] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1c2 [0082.843] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0082.843] OleInitialize (pvReserved=0x0) returned 0x0 [0082.852] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0x92f834 | out: phkResult=0x92f834*=0xd8) returned 0x0 [0082.853] RegQueryValueExW (in: hKey=0xd8, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0x92f850, lpcbData=0x92f838*=0x8 | out: lpType=0x0, lpData=0x92f850*=0x30, lpcbData=0x92f838*=0x4) returned 0x0 [0082.853] RegCloseKey (hKey=0xd8) returned 0x0 [0082.856] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x90f808, nSize=0x7fff | out: lpFilename="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe")) returned 0x5c [0082.857] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", nBufferLength=0x7fff, lpBuffer=0x8ff7f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x0) returned 0x5c [0082.858] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", nBufferLength=0x7fff, lpBuffer=0x90f814, lpFilePart=0x91f814 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x91f814*="MsMpEng.exe") returned 0x5c [0082.858] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0x91f830 | out: phkResult=0x91f830*=0x0) returned 0x2 [0082.859] IsThemeActive () returned 0x1 [0082.859] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0x92f854, fWinIni=0x0 | out: pvParam=0x92f854) returned 1 [0082.859] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 0 [0082.859] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0x91f828 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0082.859] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8ff788, nSize=0x7fff | out: lpFilename="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe")) returned 0x5c [0082.860] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", nBufferLength=0x7fff, lpBuffer=0x8ef778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x0) returned 0x5c [0082.860] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x777b0000 [0082.861] GetProcAddress (hModule=0x777b0000, lpProcName=0x2e5520) returned 0x777ebc0a [0082.861] Wow64DisableWow64FsRedirection (in: OldValue=0x90f78c | out: OldValue=0x90f78c*=0x0) returned 0 [0082.861] FreeLibrary (hLibModule=0x777b0000) returned 1 [0082.862] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x90f628, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.862] GetFileType (hFile=0xd8) returned 0x1 [0082.862] LoadLibraryExW (lpLibFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", hFile=0x0, dwFlags=0x2) returned 0x230000 [0082.862] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x777b0000 [0082.862] GetProcAddress (hModule=0x777b0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7783f5f9 [0082.862] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0082.862] FreeLibrary (hLibModule=0x777b0000) returned 1 [0082.863] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x90f7e8 | out: ppstm=0x90f7e8*=0x984988) returned 0x0 [0082.864] FindResourceExW (hModule=0x230000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x2f74c8 [0082.864] LoadResource (hModule=0x230000, hResInfo=0x2f74c8) returned 0x48d4a0 [0082.864] SizeofResource (hModule=0x230000, hResInfo=0x2f74c8) returned 0x17d1c [0082.864] LockResource (hResData=0x48d4a0) returned 0x48d4a0 [0082.864] ISequentialStream:RemoteWrite (in: This=0x984988, pv=0x48d4a0*=0xa3, cb=0x17d1c, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0082.868] IStream:RemoteSeek (in: This=0x984988, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0082.868] IStream:RemoteSeek (in: This=0x984988, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0082.869] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x988df8, cb=0x18, pcbRead=0x90f714 | out: pv=0x988df8*=0xa3, pcbRead=0x90f714*=0x18) returned 0x0 [0082.869] IStream:RemoteSeek (in: This=0x984988, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0082.869] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90f758, cb=0x4, pcbRead=0x90f714 | out: pv=0x90f758*=0x45, pcbRead=0x90f714*=0x4) returned 0x0 [0082.869] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90f77c, cb=0x10, pcbRead=0x90f754 | out: pv=0x90f77c*=0x4d, pcbRead=0x90f754*=0x10) returned 0x0 [0082.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x90f650 | out: lpSystemTimeAsFileTime=0x90f650*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.869] IStream:RemoteSeek (in: This=0x984988, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0082.869] IStream:RemoteSeek (in: This=0x984988, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0082.869] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90f0d0, cb=0x4, pcbRead=0x90ee94 | out: pv=0x90f0d0*=0x6b, pcbRead=0x90ee94*=0x4) returned 0x0 [0082.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x90ed90 | out: lpSystemTimeAsFileTime=0x90ed90*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.869] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90f0d8, cb=0x4, pcbRead=0x90ee94 | out: pv=0x90f0d8*=0xa6, pcbRead=0x90ee94*=0x4) returned 0x0 [0082.869] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90eec0, cb=0x34, pcbRead=0x90ee94 | out: pv=0x90eec0*=0xe1, pcbRead=0x90ee94*=0x34) returned 0x0 [0082.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x90ed90 | out: lpSystemTimeAsFileTime=0x90ed90*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.869] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90f0d8, cb=0x4, pcbRead=0x90ee94 | out: pv=0x90f0d8*=0x1a, pcbRead=0x90ee94*=0x4) returned 0x0 [0082.869] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90f104, cb=0x74, pcbRead=0x90ee94 | out: pv=0x90f104*=0xd, pcbRead=0x90ee94*=0x74) returned 0x0 [0082.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x90ed90 | out: lpSystemTimeAsFileTime=0x90ed90*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.870] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90f78b, cb=0x1, pcbRead=0x90f0dc | out: pv=0x90f78b*=0x0, pcbRead=0x90f0dc*=0x1) returned 0x0 [0082.870] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90f784, cb=0x4, pcbRead=0x90f0dc | out: pv=0x90f784*=0xbc, pcbRead=0x90f0dc*=0x4) returned 0x0 [0082.870] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90f784, cb=0x4, pcbRead=0x90f0dc | out: pv=0x90f784*=0xbc, pcbRead=0x90f0dc*=0x4) returned 0x0 [0082.870] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x90f784, cb=0x4, pcbRead=0x90f0dc | out: pv=0x90f784*=0x84, pcbRead=0x90f0dc*=0x4) returned 0x0 [0082.870] IStream:RemoteSeek (in: This=0x984988, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0082.870] ISequentialStream:RemoteRead (in: This=0x984988, pv=0x983a20, cb=0x0, pcbRead=0x90f0dc | out: pv=0x983a20*=0x6e, pcbRead=0x90f0dc*=0x0) returned 0x0 [0082.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x90efd8 | out: lpSystemTimeAsFileTime=0x90efd8*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.870] CloseHandle (hObject=0xd8) returned 1 [0082.870] IUnknown:Release (This=0x984988) returned 0x0 [0082.870] FreeLibrary (hLibModule=0x230000) returned 1 [0082.871] IsDebuggerPresent () returned 0 [0082.871] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", nBufferLength=0x7fff, lpBuffer=0x8ef7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x0) returned 0x5c [0082.871] GetLongPathNameW (in: lpszShortPath="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpszLongPath=0x8ef7a0, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe") returned 0x5c [0082.872] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", nBufferLength=0x7fff, lpBuffer=0x8ef770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x0) returned 0x5c [0082.872] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x777b0000 [0082.872] GetProcAddress (hModule=0x777b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x777ebc0a [0082.872] Wow64DisableWow64FsRedirection (in: OldValue=0x8ff70c | out: OldValue=0x8ff70c*=0x0) returned 0 [0082.872] FreeLibrary (hLibModule=0x777b0000) returned 1 [0082.872] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x8ff5a8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.873] GetFileType (hFile=0xd8) returned 0x1 [0082.873] LoadLibraryExW (lpLibFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", hFile=0x0, dwFlags=0x2) returned 0x230000 [0082.873] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x777b0000 [0082.873] GetProcAddress (hModule=0x777b0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7783f5f9 [0082.873] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0082.873] FreeLibrary (hLibModule=0x777b0000) returned 1 [0082.873] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x8ff73c | out: ppstm=0x8ff73c*=0x984a78) returned 0x0 [0082.873] FindResourceExW (hModule=0x230000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x2f74c8 [0082.873] LoadResource (hModule=0x230000, hResInfo=0x2f74c8) returned 0x48d4a0 [0082.873] SizeofResource (hModule=0x230000, hResInfo=0x2f74c8) returned 0x17d1c [0082.873] LockResource (hResData=0x48d4a0) returned 0x48d4a0 [0082.873] ISequentialStream:RemoteWrite (in: This=0x984a78, pv=0x48d4a0*=0xa3, cb=0x17d1c, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0082.873] IStream:RemoteSeek (in: This=0x984a78, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0082.873] IStream:RemoteSeek (in: This=0x984a78, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0082.873] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x9891a8, cb=0x18, pcbRead=0x8ff694 | out: pv=0x9891a8*=0xa3, pcbRead=0x8ff694*=0x18) returned 0x0 [0082.873] IStream:RemoteSeek (in: This=0x984a78, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0082.873] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff6d8, cb=0x4, pcbRead=0x8ff694 | out: pv=0x8ff6d8*=0x45, pcbRead=0x8ff694*=0x4) returned 0x0 [0082.873] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff6fc, cb=0x10, pcbRead=0x8ff6d4 | out: pv=0x8ff6fc*=0x4d, pcbRead=0x8ff6d4*=0x10) returned 0x0 [0082.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8ff5d0 | out: lpSystemTimeAsFileTime=0x8ff5d0*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.873] IStream:RemoteSeek (in: This=0x984a78, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0082.874] IStream:RemoteSeek (in: This=0x984a78, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff050, cb=0x4, pcbRead=0x8fee14 | out: pv=0x8ff050*=0x6b, pcbRead=0x8fee14*=0x4) returned 0x0 [0082.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8fed10 | out: lpSystemTimeAsFileTime=0x8fed10*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff058, cb=0x4, pcbRead=0x8fee14 | out: pv=0x8ff058*=0xa6, pcbRead=0x8fee14*=0x4) returned 0x0 [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8fee40, cb=0x34, pcbRead=0x8fee14 | out: pv=0x8fee40*=0xe1, pcbRead=0x8fee14*=0x34) returned 0x0 [0082.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8fed10 | out: lpSystemTimeAsFileTime=0x8fed10*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff058, cb=0x4, pcbRead=0x8fee14 | out: pv=0x8ff058*=0x1a, pcbRead=0x8fee14*=0x4) returned 0x0 [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff084, cb=0x74, pcbRead=0x8fee14 | out: pv=0x8ff084*=0xd, pcbRead=0x8fee14*=0x74) returned 0x0 [0082.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8fed10 | out: lpSystemTimeAsFileTime=0x8fed10*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.874] IStream:RemoteSeek (in: This=0x984a78, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff048, cb=0x4, pcbRead=0x8fee14 | out: pv=0x8ff048*=0xbc, pcbRead=0x8fee14*=0x4) returned 0x0 [0082.874] IStream:RemoteSeek (in: This=0x984a78, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff050, cb=0x4, pcbRead=0x8fee14 | out: pv=0x8ff050*=0x6b, pcbRead=0x8fee14*=0x4) returned 0x0 [0082.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8fed10 | out: lpSystemTimeAsFileTime=0x8fed10*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff058, cb=0x4, pcbRead=0x8fee14 | out: pv=0x8ff058*=0xaf, pcbRead=0x8fee14*=0x4) returned 0x0 [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8fee40, cb=0x26, pcbRead=0x8fee14 | out: pv=0x8fee40*=0xe6, pcbRead=0x8fee14*=0x26) returned 0x0 [0082.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8fed10 | out: lpSystemTimeAsFileTime=0x8fed10*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff058, cb=0x4, pcbRead=0x8fee14 | out: pv=0x8ff058*=0x1e, pcbRead=0x8fee14*=0x4) returned 0x0 [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff084, cb=0x7c, pcbRead=0x8fee14 | out: pv=0x8ff084*=0xff, pcbRead=0x8fee14*=0x7c) returned 0x0 [0082.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8fed10 | out: lpSystemTimeAsFileTime=0x8fed10*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff70b, cb=0x1, pcbRead=0x8ff05c | out: pv=0x8ff70b*=0x1, pcbRead=0x8ff05c*=0x1) returned 0x0 [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff704, cb=0x4, pcbRead=0x8ff05c | out: pv=0x8ff704*=0xec, pcbRead=0x8ff05c*=0x4) returned 0x0 [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff704, cb=0x4, pcbRead=0x8ff05c | out: pv=0x8ff704*=0x65, pcbRead=0x8ff05c*=0x4) returned 0x0 [0082.874] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x8ff704, cb=0x4, pcbRead=0x8ff05c | out: pv=0x8ff704*=0x6, pcbRead=0x8ff05c*=0x4) returned 0x0 [0082.875] IStream:RemoteSeek (in: This=0x984a78, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0082.875] ISequentialStream:RemoteRead (in: This=0x984a78, pv=0x9b0ee0, cb=0x17b50, pcbRead=0x8ff05c | out: pv=0x9b0ee0*=0x6d, pcbRead=0x8ff05c*=0x17b50) returned 0x0 [0082.876] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8fef58 | out: lpSystemTimeAsFileTime=0x8fef58*(dwLowDateTime=0x1ff149f0, dwHighDateTime=0x1d4b1a5)) [0082.981] CloseHandle (hObject=0xd8) returned 1 [0082.981] IUnknown:Release (This=0x984a78) returned 0x0 [0082.981] FreeLibrary (hLibModule=0x230000) returned 1 [0082.981] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", nBufferLength=0x7fff, lpBuffer=0x90f828, lpFilePart=0x92f848 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x92f848*="MsMpEng.exe") returned 0x5c [0082.982] CharUpperBuffW (in: lpsz="SJFZLYEDBWKTCRUEK", cchLength=0x11 | out: lpsz="SJFZLYEDBWKTCRUEK") returned 0x11 [0082.982] CharUpperBuffW (in: lpsz="EOYHLBQUNPHWLCZHVIPGMR", cchLength=0x16 | out: lpsz="EOYHLBQUNPHWLCZHVIPGMR") returned 0x16 [0082.982] CharUpperBuffW (in: lpsz="EOYHLBQUNPHWLCZHVIPGMR", cchLength=0x16 | out: lpsz="EOYHLBQUNPHWLCZHVIPGMR") returned 0x16 [0082.982] CharUpperBuffW (in: lpsz="DAVCLYVQGTNBHSUXQQGTWIDRKD", cchLength=0x1a | out: lpsz="DAVCLYVQGTNBHSUXQQGTWIDRKD") returned 0x1a [0082.982] CharUpperBuffW (in: lpsz="DAVCLYVQGTNBHSUXQQGTWIDRKD", cchLength=0x1a | out: lpsz="DAVCLYVQGTNBHSUXQQGTWIDRKD") returned 0x1a [0082.982] CharUpperBuffW (in: lpsz="DECDATA", cchLength=0x7 | out: lpsz="DECDATA") returned 0x7 [0082.982] CharUpperBuffW (in: lpsz="DECDATA", cchLength=0x7 | out: lpsz="DECDATA") returned 0x7 [0082.983] CharUpperBuffW (in: lpsz="UAGZWDHRVSWIIOZRGDCPBLBXX", cchLength=0x19 | out: lpsz="UAGZWDHRVSWIIOZRGDCPBLBXX") returned 0x19 [0082.983] CharUpperBuffW (in: lpsz="UAGZWDHRVSWIIOZRGDCPBLBXX", cchLength=0x19 | out: lpsz="UAGZWDHRVSWIIOZRGDCPBLBXX") returned 0x19 [0082.983] CharUpperBuffW (in: lpsz="HQJBCVHQCFCNTHXYDMIHVKRUQEWC", cchLength=0x1c | out: lpsz="HQJBCVHQCFCNTHXYDMIHVKRUQEWC") returned 0x1c [0082.983] CharUpperBuffW (in: lpsz="HQJBCVHQCFCNTHXYDMIHVKRUQEWC", cchLength=0x1c | out: lpsz="HQJBCVHQCFCNTHXYDMIHVKRUQEWC") returned 0x1c [0082.983] CharUpperBuffW (in: lpsz="IGYGYWWHUIQCQOQQYNKW", cchLength=0x14 | out: lpsz="IGYGYWWHUIQCQOQQYNKW") returned 0x14 [0082.983] CharUpperBuffW (in: lpsz="IGYGYWWHUIQCQOQQYNKW", cchLength=0x14 | out: lpsz="IGYGYWWHUIQCQOQQYNKW") returned 0x14 [0082.983] CharUpperBuffW (in: lpsz="VCIKFNQMTNFUTAZVGLPLO", cchLength=0x15 | out: lpsz="VCIKFNQMTNFUTAZVGLPLO") returned 0x15 [0082.983] CharUpperBuffW (in: lpsz="VCIKFNQMTNFUTAZVGLPLO", cchLength=0x15 | out: lpsz="VCIKFNQMTNFUTAZVGLPLO") returned 0x15 [0082.983] CharUpperBuffW (in: lpsz="ANTIEMULATION", cchLength=0xd | out: lpsz="ANTIEMULATION") returned 0xd [0082.983] CharUpperBuffW (in: lpsz="ANTIEMULATION", cchLength=0xd | out: lpsz="ANTIEMULATION") returned 0xd [0082.983] CharUpperBuffW (in: lpsz="CUKXVXVZGVOUEYETKUUTEC", cchLength=0x16 | out: lpsz="CUKXVXVZGVOUEYETKUUTEC") returned 0x16 [0082.983] CharUpperBuffW (in: lpsz="CUKXVXVZGVOUEYETKUUTEC", cchLength=0x16 | out: lpsz="CUKXVXVZGVOUEYETKUUTEC") returned 0x16 [0082.983] CharUpperBuffW (in: lpsz="SYGWYUJDMHO", cchLength=0xb | out: lpsz="SYGWYUJDMHO") returned 0xb [0082.984] CharUpperBuffW (in: lpsz="SYGWYUJDMHO", cchLength=0xb | out: lpsz="SYGWYUJDMHO") returned 0xb [0082.984] CharUpperBuffW (in: lpsz="DDELCTKAWMVJXSIZKVKR", cchLength=0x14 | out: lpsz="DDELCTKAWMVJXSIZKVKR") returned 0x14 [0082.984] CharUpperBuffW (in: lpsz="DDELCTKAWMVJXSIZKVKR", cchLength=0x14 | out: lpsz="DDELCTKAWMVJXSIZKVKR") returned 0x14 [0082.984] CharUpperBuffW (in: lpsz="LAJPUUBTAUPYKYTXN", cchLength=0x11 | out: lpsz="LAJPUUBTAUPYKYTXN") returned 0x11 [0082.984] CharUpperBuffW (in: lpsz="LAJPUUBTAUPYKYTXN", cchLength=0x11 | out: lpsz="LAJPUUBTAUPYKYTXN") returned 0x11 [0082.984] CharUpperBuffW (in: lpsz="TPAGBHUBMCHOAAR", cchLength=0xf | out: lpsz="TPAGBHUBMCHOAAR") returned 0xf [0082.984] CharUpperBuffW (in: lpsz="TPAGBHUBMCHOAAR", cchLength=0xf | out: lpsz="TPAGBHUBMCHOAAR") returned 0xf [0082.984] CharUpperBuffW (in: lpsz="MMPUJJOGMCCXLHZBUFDEPEWFOAU", cchLength=0x1b | out: lpsz="MMPUJJOGMCCXLHZBUFDEPEWFOAU") returned 0x1b [0082.984] CharUpperBuffW (in: lpsz="MMPUJJOGMCCXLHZBUFDEPEWFOAU", cchLength=0x1b | out: lpsz="MMPUJJOGMCCXLHZBUFDEPEWFOAU") returned 0x1b [0082.984] CharUpperBuffW (in: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK", cchLength=0x19 | out: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK") returned 0x19 [0082.984] CharUpperBuffW (in: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK", cchLength=0x19 | out: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK") returned 0x19 [0082.984] CharUpperBuffW (in: lpsz="EYUGCPDIYNRZXLSBKUGV", cchLength=0x14 | out: lpsz="EYUGCPDIYNRZXLSBKUGV") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="EYUGCPDIYNRZXLSBKUGV", cchLength=0x14 | out: lpsz="EYUGCPDIYNRZXLSBKUGV") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="VAWBPFJARYLSY_LWN__Z", cchLength=0x14 | out: lpsz="VAWBPFJARYLSY_LWN__Z") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="VAWBPFJARYLSY_LWN__Z", cchLength=0x14 | out: lpsz="VAWBPFJARYLSY_LWN__Z") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="PFTJCVYTZWZHJNBFDSVH", cchLength=0x14 | out: lpsz="PFTJCVYTZWZHJNBFDSVH") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="PFTJCVYTZWZHJNBFDSVH", cchLength=0x14 | out: lpsz="PFTJCVYTZWZHJNBFDSVH") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="PWGBLLCVBIWPGOVCYHST", cchLength=0x14 | out: lpsz="PWGBLLCVBIWPGOVCYHST") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="PWGBLLCVBIWPGOVCYHST", cchLength=0x14 | out: lpsz="PWGBLLCVBIWPGOVCYHST") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="QBAVKKEPMGFRIDJIQFYL", cchLength=0x14 | out: lpsz="QBAVKKEPMGFRIDJIQFYL") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="QBAVKKEPMGFRIDJIQFYL", cchLength=0x14 | out: lpsz="QBAVKKEPMGFRIDJIQFYL") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="ZHFSEIECLKQLCIGLUFVW", cchLength=0x14 | out: lpsz="ZHFSEIECLKQLCIGLUFVW") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="ZHFSEIECLKQLCIGLUFVW", cchLength=0x14 | out: lpsz="ZHFSEIECLKQLCIGLUFVW") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="ZASLDIOHJDVRTPWQRMGV", cchLength=0x14 | out: lpsz="ZASLDIOHJDVRTPWQRMGV") returned 0x14 [0082.985] CharUpperBuffW (in: lpsz="ZASLDIOHJDVRTPWQRMGV", cchLength=0x14 | out: lpsz="ZASLDIOHJDVRTPWQRMGV") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="JSKPHBPSKKETVRDBHNYU", cchLength=0x14 | out: lpsz="JSKPHBPSKKETVRDBHNYU") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="JSKPHBPSKKETVRDBHNYU", cchLength=0x14 | out: lpsz="JSKPHBPSKKETVRDBHNYU") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="M_INUGTJHWXCPAXMCTAI", cchLength=0x14 | out: lpsz="M_INUGTJHWXCPAXMCTAI") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="M_INUGTJHWXCPAXMCTAI", cchLength=0x14 | out: lpsz="M_INUGTJHWXCPAXMCTAI") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="BNSYFESKKKXMBYSQHJIQ", cchLength=0x14 | out: lpsz="BNSYFESKKKXMBYSQHJIQ") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="BNSYFESKKKXMBYSQHJIQ", cchLength=0x14 | out: lpsz="BNSYFESKKKXMBYSQHJIQ") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="LSGCAGMKVJRPUYNSDWVN", cchLength=0x14 | out: lpsz="LSGCAGMKVJRPUYNSDWVN") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="LSGCAGMKVJRPUYNSDWVN", cchLength=0x14 | out: lpsz="LSGCAGMKVJRPUYNSDWVN") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="FDVIELPYQBHFBSHKWRNV", cchLength=0x14 | out: lpsz="FDVIELPYQBHFBSHKWRNV") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="FDVIELPYQBHFBSHKWRNV", cchLength=0x14 | out: lpsz="FDVIELPYQBHFBSHKWRNV") returned 0x14 [0082.986] CharUpperBuffW (in: lpsz="ISJEZZKAOCFKNHTKJDQV", cchLength=0x14 | out: lpsz="ISJEZZKAOCFKNHTKJDQV") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="ISJEZZKAOCFKNHTKJDQV", cchLength=0x14 | out: lpsz="ISJEZZKAOCFKNHTKJDQV") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="MUSXQUMBQMSLTQRKARJJ", cchLength=0x14 | out: lpsz="MUSXQUMBQMSLTQRKARJJ") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="MUSXQUMBQMSLTQRKARJJ", cchLength=0x14 | out: lpsz="MUSXQUMBQMSLTQRKARJJ") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="NOTRRKJGTFVXPFAOQZVF", cchLength=0x14 | out: lpsz="NOTRRKJGTFVXPFAOQZVF") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="NOTRRKJGTFVXPFAOQZVF", cchLength=0x14 | out: lpsz="NOTRRKJGTFVXPFAOQZVF") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="JUPVPXOMUFXFQHXUCWSH", cchLength=0x14 | out: lpsz="JUPVPXOMUFXFQHXUCWSH") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="JUPVPXOMUFXFQHXUCWSH", cchLength=0x14 | out: lpsz="JUPVPXOMUFXFQHXUCWSH") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="PRASBOPNM_MGRQFGBQCF", cchLength=0x14 | out: lpsz="PRASBOPNM_MGRQFGBQCF") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="PRASBOPNM_MGRQFGBQCF", cchLength=0x14 | out: lpsz="PRASBOPNM_MGRQFGBQCF") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="QUUZWZOLIYMFBCZKMNKZ", cchLength=0x14 | out: lpsz="QUUZWZOLIYMFBCZKMNKZ") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="QUUZWZOLIYMFBCZKMNKZ", cchLength=0x14 | out: lpsz="QUUZWZOLIYMFBCZKMNKZ") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="NVDECIIZNY_FJETTNKCF", cchLength=0x14 | out: lpsz="NVDECIIZNY_FJETTNKCF") returned 0x14 [0082.987] CharUpperBuffW (in: lpsz="NVDECIIZNY_FJETTNKCF", cchLength=0x14 | out: lpsz="NVDECIIZNY_FJETTNKCF") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="JCBCSQJKBAHQJLQPHFQD", cchLength=0x14 | out: lpsz="JCBCSQJKBAHQJLQPHFQD") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="JCBCSQJKBAHQJLQPHFQD", cchLength=0x14 | out: lpsz="JCBCSQJKBAHQJLQPHFQD") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="KAHBDEOIEXWXMYTRRTOX", cchLength=0x14 | out: lpsz="KAHBDEOIEXWXMYTRRTOX") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="KAHBDEOIEXWXMYTRRTOX", cchLength=0x14 | out: lpsz="KAHBDEOIEXWXMYTRRTOX") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="ZHMUXYEMHNIVGJBJDMMF", cchLength=0x14 | out: lpsz="ZHMUXYEMHNIVGJBJDMMF") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="ZHMUXYEMHNIVGJBJDMMF", cchLength=0x14 | out: lpsz="ZHMUXYEMHNIVGJBJDMMF") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="VMLKPAFPAPNKNHTCBZRR", cchLength=0x14 | out: lpsz="VMLKPAFPAPNKNHTCBZRR") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="VMLKPAFPAPNKNHTCBZRR", cchLength=0x14 | out: lpsz="VMLKPAFPAPNKNHTCBZRR") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="REDKXUVIBQAOCPLAQHXB", cchLength=0x14 | out: lpsz="REDKXUVIBQAOCPLAQHXB") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="REDKXUVIBQAOCPLAQHXB", cchLength=0x14 | out: lpsz="REDKXUVIBQAOCPLAQHXB") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="OJTKASVFTSYXKBWX_WNX", cchLength=0x14 | out: lpsz="OJTKASVFTSYXKBWX_WNX") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="OJTKASVFTSYXKBWX_WNX", cchLength=0x14 | out: lpsz="OJTKASVFTSYXKBWX_WNX") returned 0x14 [0082.988] CharUpperBuffW (in: lpsz="ZAWMLSAXDCXMHRNMO_WJ", cchLength=0x14 | out: lpsz="ZAWMLSAXDCXMHRNMO_WJ") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="ZAWMLSAXDCXMHRNMO_WJ", cchLength=0x14 | out: lpsz="ZAWMLSAXDCXMHRNMO_WJ") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="PHPGCBELK_YPOEERMNXJ", cchLength=0x14 | out: lpsz="PHPGCBELK_YPOEERMNXJ") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="PHPGCBELK_YPOEERMNXJ", cchLength=0x14 | out: lpsz="PHPGCBELK_YPOEERMNXJ") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="WOCMAOSQEUUABGNESWBM", cchLength=0x14 | out: lpsz="WOCMAOSQEUUABGNESWBM") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="WOCMAOSQEUUABGNESWBM", cchLength=0x14 | out: lpsz="WOCMAOSQEUUABGNESWBM") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="KGPWKXXEFKMQLGNWECVG", cchLength=0x14 | out: lpsz="KGPWKXXEFKMQLGNWECVG") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="KGPWKXXEFKMQLGNWECVG", cchLength=0x14 | out: lpsz="KGPWKXXEFKMQLGNWECVG") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="MAHKEWEXGTPUVKVEGPO_", cchLength=0x14 | out: lpsz="MAHKEWEXGTPUVKVEGPO_") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="MAHKEWEXGTPUVKVEGPO_", cchLength=0x14 | out: lpsz="MAHKEWEXGTPUVKVEGPO_") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="_YWCISGXTVBDUOVXPQMI", cchLength=0x14 | out: lpsz="_YWCISGXTVBDUOVXPQMI") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="_YWCISGXTVBDUOVXPQMI", cchLength=0x14 | out: lpsz="_YWCISGXTVBDUOVXPQMI") returned 0x14 [0082.989] CharUpperBuffW (in: lpsz="DUZNPLRFXOELYOJWMYRZ", cchLength=0x14 | out: lpsz="DUZNPLRFXOELYOJWMYRZ") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="DUZNPLRFXOELYOJWMYRZ", cchLength=0x14 | out: lpsz="DUZNPLRFXOELYOJWMYRZ") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="JXHOFWTYAAIMRXVFTQE_", cchLength=0x14 | out: lpsz="JXHOFWTYAAIMRXVFTQE_") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="JXHOFWTYAAIMRXVFTQE_", cchLength=0x14 | out: lpsz="JXHOFWTYAAIMRXVFTQE_") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="SACWIMSIHENVHPTUMXPE", cchLength=0x14 | out: lpsz="SACWIMSIHENVHPTUMXPE") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="SACWIMSIHENVHPTUMXPE", cchLength=0x14 | out: lpsz="SACWIMSIHENVHPTUMXPE") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="XUULJMNSYNUPYVWXSZYG", cchLength=0x14 | out: lpsz="XUULJMNSYNUPYVWXSZYG") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="XUULJMNSYNUPYVWXSZYG", cchLength=0x14 | out: lpsz="XUULJMNSYNUPYVWXSZYG") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="GSMCLNXRCRDHAXIOWENF", cchLength=0x14 | out: lpsz="GSMCLNXRCRDHAXIOWENF") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="GSMCLNXRCRDHAXIOWENF", cchLength=0x14 | out: lpsz="GSMCLNXRCRDHAXIOWENF") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="DLESKBDQQFCHDDDMIDEA", cchLength=0x14 | out: lpsz="DLESKBDQQFCHDDDMIDEA") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="DLESKBDQQFCHDDDMIDEA", cchLength=0x14 | out: lpsz="DLESKBDQQFCHDDDMIDEA") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="XHOSXSKKYFMAUHTBFHCA", cchLength=0x14 | out: lpsz="XHOSXSKKYFMAUHTBFHCA") returned 0x14 [0082.990] CharUpperBuffW (in: lpsz="XHOSXSKKYFMAUHTBFHCA", cchLength=0x14 | out: lpsz="XHOSXSKKYFMAUHTBFHCA") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="_QEYKFIAHEYCACPPUXWV", cchLength=0x14 | out: lpsz="_QEYKFIAHEYCACPPUXWV") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="_QEYKFIAHEYCACPPUXWV", cchLength=0x14 | out: lpsz="_QEYKFIAHEYCACPPUXWV") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="M_FBUIIQDAGUAU_RACCL", cchLength=0x14 | out: lpsz="M_FBUIIQDAGUAU_RACCL") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="M_FBUIIQDAGUAU_RACCL", cchLength=0x14 | out: lpsz="M_FBUIIQDAGUAU_RACCL") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="NDCHJOSUDZTBTGVUCWDB", cchLength=0x14 | out: lpsz="NDCHJOSUDZTBTGVUCWDB") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="NDCHJOSUDZTBTGVUCWDB", cchLength=0x14 | out: lpsz="NDCHJOSUDZTBTGVUCWDB") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="ERXPGKRYZYLSLKZDSACZ", cchLength=0x14 | out: lpsz="ERXPGKRYZYLSLKZDSACZ") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="ERXPGKRYZYLSLKZDSACZ", cchLength=0x14 | out: lpsz="ERXPGKRYZYLSLKZDSACZ") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="FZMDXRSNTFQG_ZPUEHLH", cchLength=0x14 | out: lpsz="FZMDXRSNTFQG_ZPUEHLH") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="FZMDXRSNTFQG_ZPUEHLH", cchLength=0x14 | out: lpsz="FZMDXRSNTFQG_ZPUEHLH") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="BRMZWPJQKKWFLEAGBXUX", cchLength=0x14 | out: lpsz="BRMZWPJQKKWFLEAGBXUX") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="BRMZWPJQKKWFLEAGBXUX", cchLength=0x14 | out: lpsz="BRMZWPJQKKWFLEAGBXUX") returned 0x14 [0082.991] CharUpperBuffW (in: lpsz="ETDESII_JCPEKLNFZOOK", cchLength=0x14 | out: lpsz="ETDESII_JCPEKLNFZOOK") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="ETDESII_JCPEKLNFZOOK", cchLength=0x14 | out: lpsz="ETDESII_JCPEKLNFZOOK") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="WJNZPVCEXYQAWKKAOPXE", cchLength=0x14 | out: lpsz="WJNZPVCEXYQAWKKAOPXE") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="WJNZPVCEXYQAWKKAOPXE", cchLength=0x14 | out: lpsz="WJNZPVCEXYQAWKKAOPXE") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="RZBCABNWUPZLBALLSEYP", cchLength=0x14 | out: lpsz="RZBCABNWUPZLBALLSEYP") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="RZBCABNWUPZLBALLSEYP", cchLength=0x14 | out: lpsz="RZBCABNWUPZLBALLSEYP") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="ZU_OYEQNTWHCWPJPGJNX", cchLength=0x14 | out: lpsz="ZU_OYEQNTWHCWPJPGJNX") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="ZU_OYEQNTWHCWPJPGJNX", cchLength=0x14 | out: lpsz="ZU_OYEQNTWHCWPJPGJNX") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="GFJLYFLSIGQNQEMTCMBN", cchLength=0x14 | out: lpsz="GFJLYFLSIGQNQEMTCMBN") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="GFJLYFLSIGQNQEMTCMBN", cchLength=0x14 | out: lpsz="GFJLYFLSIGQNQEMTCMBN") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="ADRCTQTHUSOPR_NYNBYS", cchLength=0x14 | out: lpsz="ADRCTQTHUSOPR_NYNBYS") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="ADRCTQTHUSOPR_NYNBYS", cchLength=0x14 | out: lpsz="ADRCTQTHUSOPR_NYNBYS") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="XYVOCQGEPGTRBENKHFBB", cchLength=0x14 | out: lpsz="XYVOCQGEPGTRBENKHFBB") returned 0x14 [0082.992] CharUpperBuffW (in: lpsz="XYVOCQGEPGTRBENKHFBB", cchLength=0x14 | out: lpsz="XYVOCQGEPGTRBENKHFBB") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="NKYYMWXNOLVPNJOWSPHU", cchLength=0x14 | out: lpsz="NKYYMWXNOLVPNJOWSPHU") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="NKYYMWXNOLVPNJOWSPHU", cchLength=0x14 | out: lpsz="NKYYMWXNOLVPNJOWSPHU") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="NZPZJNK_OOFQCFTPSFQU", cchLength=0x14 | out: lpsz="NZPZJNK_OOFQCFTPSFQU") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="NZPZJNK_OOFQCFTPSFQU", cchLength=0x14 | out: lpsz="NZPZJNK_OOFQCFTPSFQU") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="_WDEFSLTADBXLOGIGOKQ", cchLength=0x14 | out: lpsz="_WDEFSLTADBXLOGIGOKQ") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="_WDEFSLTADBXLOGIGOKQ", cchLength=0x14 | out: lpsz="_WDEFSLTADBXLOGIGOKQ") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="VDHLJOMTHWSZYHONMRPF", cchLength=0x14 | out: lpsz="VDHLJOMTHWSZYHONMRPF") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="VDHLJOMTHWSZYHONMRPF", cchLength=0x14 | out: lpsz="VDHLJOMTHWSZYHONMRPF") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="CQLUJ_MIJQXUMXGTZSLA", cchLength=0x14 | out: lpsz="CQLUJ_MIJQXUMXGTZSLA") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="CQLUJ_MIJQXUMXGTZSLA", cchLength=0x14 | out: lpsz="CQLUJ_MIJQXUMXGTZSLA") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="ERJFYBLH_EEKVPIUETBO", cchLength=0x14 | out: lpsz="ERJFYBLH_EEKVPIUETBO") returned 0x14 [0082.993] CharUpperBuffW (in: lpsz="ERJFYBLH_EEKVPIUETBO", cchLength=0x14 | out: lpsz="ERJFYBLH_EEKVPIUETBO") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="NLYSVERQJQDWHOOLQLYL", cchLength=0x14 | out: lpsz="NLYSVERQJQDWHOOLQLYL") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="NLYSVERQJQDWHOOLQLYL", cchLength=0x14 | out: lpsz="NLYSVERQJQDWHOOLQLYL") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="NBOKCHBJGETDUGZSYLQY", cchLength=0x14 | out: lpsz="NBOKCHBJGETDUGZSYLQY") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="NBOKCHBJGETDUGZSYLQY", cchLength=0x14 | out: lpsz="NBOKCHBJGETDUGZSYLQY") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="JXHAAZUGXKRTOPRLOCDH", cchLength=0x14 | out: lpsz="JXHAAZUGXKRTOPRLOCDH") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="JXHAAZUGXKRTOPRLOCDH", cchLength=0x14 | out: lpsz="JXHAAZUGXKRTOPRLOCDH") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="KRIUJDYJ_INOVOBOWTOE", cchLength=0x14 | out: lpsz="KRIUJDYJ_INOVOBOWTOE") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="KRIUJDYJ_INOVOBOWTOE", cchLength=0x14 | out: lpsz="KRIUJDYJ_INOVOBOWTOE") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="JILVZZMFCQJIPRSAQDGA", cchLength=0x14 | out: lpsz="JILVZZMFCQJIPRSAQDGA") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="JILVZZMFCQJIPRSAQDGA", cchLength=0x14 | out: lpsz="JILVZZMFCQJIPRSAQDGA") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="SEMOFSJXFIHCUVZS_MIF", cchLength=0x14 | out: lpsz="SEMOFSJXFIHCUVZS_MIF") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="SEMOFSJXFIHCUVZS_MIF", cchLength=0x14 | out: lpsz="SEMOFSJXFIHCUVZS_MIF") returned 0x14 [0082.994] CharUpperBuffW (in: lpsz="KS_WLIBBMU_BWHTBD_FA", cchLength=0x14 | out: lpsz="KS_WLIBBMU_BWHTBD_FA") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="KS_WLIBBMU_BWHTBD_FA", cchLength=0x14 | out: lpsz="KS_WLIBBMU_BWHTBD_FA") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="LBKYTTUGWOPLNRBUXJVF", cchLength=0x14 | out: lpsz="LBKYTTUGWOPLNRBUXJVF") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="LBKYTTUGWOPLNRBUXJVF", cchLength=0x14 | out: lpsz="LBKYTTUGWOPLNRBUXJVF") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="GYAAGFSRUS_WEXXHMQDR", cchLength=0x14 | out: lpsz="GYAAGFSRUS_WEXXHMQDR") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="GYAAGFSRUS_WEXXHMQDR", cchLength=0x14 | out: lpsz="GYAAGFSRUS_WEXXHMQDR") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="FUKCVTWBKZATQJEONCFE", cchLength=0x14 | out: lpsz="FUKCVTWBKZATQJEONCFE") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="FUKCVTWBKZATQJEONCFE", cchLength=0x14 | out: lpsz="FUKCVTWBKZATQJEONCFE") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="PFDZDKAWIWUBSRKHSTXB", cchLength=0x14 | out: lpsz="PFDZDKAWIWUBSRKHSTXB") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="PFDZDKAWIWUBSRKHSTXB", cchLength=0x14 | out: lpsz="PFDZDKAWIWUBSRKHSTXB") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="SDHFVWXBSMFLZZLCLCSA", cchLength=0x14 | out: lpsz="SDHFVWXBSMFLZZLCLCSA") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="SDHFVWXBSMFLZZLCLCSA", cchLength=0x14 | out: lpsz="SDHFVWXBSMFLZZLCLCSA") returned 0x14 [0082.995] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="WTDXRHKKKXUKQCKMTZIJ", cchLength=0x14 | out: lpsz="WTDXRHKKKXUKQCKMTZIJ") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="WTDXRHKKKXUKQCKMTZIJ", cchLength=0x14 | out: lpsz="WTDXRHKKKXUKQCKMTZIJ") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="QVDTDQKIHNLXDKKOMDSS", cchLength=0x14 | out: lpsz="QVDTDQKIHNLXDKKOMDSS") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="QVDTDQKIHNLXDKKOMDSS", cchLength=0x14 | out: lpsz="QVDTDQKIHNLXDKKOMDSS") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="BDRETLGTCOAMGSETKRIV", cchLength=0x14 | out: lpsz="BDRETLGTCOAMGSETKRIV") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="BDRETLGTCOAMGSETKRIV", cchLength=0x14 | out: lpsz="BDRETLGTCOAMGSETKRIV") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="OKGOETBUJSOWLZUQGPUN", cchLength=0x14 | out: lpsz="OKGOETBUJSOWLZUQGPUN") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="OKGOETBUJSOWLZUQGPUN", cchLength=0x14 | out: lpsz="OKGOETBUJSOWLZUQGPUN") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="SJAGSYGNOFBHGQYVBIAZ", cchLength=0x14 | out: lpsz="SJAGSYGNOFBHGQYVBIAZ") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="SJAGSYGNOFBHGQYVBIAZ", cchLength=0x14 | out: lpsz="SJAGSYGNOFBHGQYVBIAZ") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="PKQYPLUXIWNVIUIEYBXY", cchLength=0x14 | out: lpsz="PKQYPLUXIWNVIUIEYBXY") returned 0x14 [0082.996] CharUpperBuffW (in: lpsz="PKQYPLUXIWNVIUIEYBXY", cchLength=0x14 | out: lpsz="PKQYPLUXIWNVIUIEYBXY") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="JWHXOPFWQMM_RWIDFEIZ", cchLength=0x14 | out: lpsz="JWHXOPFWQMM_RWIDFEIZ") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="JWHXOPFWQMM_RWIDFEIZ", cchLength=0x14 | out: lpsz="JWHXOPFWQMM_RWIDFEIZ") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="CLTNRMILWABNEYVBTHMG", cchLength=0x14 | out: lpsz="CLTNRMILWABNEYVBTHMG") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="CLTNRMILWABNEYVBTHMG", cchLength=0x14 | out: lpsz="CLTNRMILWABNEYVBTHMG") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="RKOBNPFBPHXZWQZEEFKL", cchLength=0x14 | out: lpsz="RKOBNPFBPHXZWQZEEFKL") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="RKOBNPFBPHXZWQZEEFKL", cchLength=0x14 | out: lpsz="RKOBNPFBPHXZWQZEEFKL") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="SSNIKPUAWTSFVFAAUJUJ", cchLength=0x14 | out: lpsz="SSNIKPUAWTSFVFAAUJUJ") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="SSNIKPUAWTSFVFAAUJUJ", cchLength=0x14 | out: lpsz="SSNIKPUAWTSFVFAAUJUJ") returned 0x14 [0082.997] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="SBWDVAJARWXSENESDBPB", cchLength=0x14 | out: lpsz="SBWDVAJARWXSENESDBPB") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="SBWDVAJARWXSENESDBPB", cchLength=0x14 | out: lpsz="SBWDVAJARWXSENESDBPB") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="YHNGDJBMMGM_MOVOJOFD", cchLength=0x14 | out: lpsz="YHNGDJBMMGM_MOVOJOFD") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="YHNGDJBMMGM_MOVOJOFD", cchLength=0x14 | out: lpsz="YHNGDJBMMGM_MOVOJOFD") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="AWRLSHYJRTOGTGYECYTE", cchLength=0x14 | out: lpsz="AWRLSHYJRTOGTGYECYTE") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="AWRLSHYJRTOGTGYECYTE", cchLength=0x14 | out: lpsz="AWRLSHYJRTOGTGYECYTE") returned 0x14 [0082.998] CharUpperBuffW (in: lpsz="BTBIGLIXGBUHCJQRWWGP", cchLength=0x14 | out: lpsz="BTBIGLIXGBUHCJQRWWGP") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="BTBIGLIXGBUHCJQRWWGP", cchLength=0x14 | out: lpsz="BTBIGLIXGBUHCJQRWWGP") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="GRPZSIBHHZBJMXFNJCJQ", cchLength=0x14 | out: lpsz="GRPZSIBHHZBJMXFNJCJQ") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="GRPZSIBHHZBJMXFNJCJQ", cchLength=0x14 | out: lpsz="GRPZSIBHHZBJMXFNJCJQ") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="AMQDEPVGRFKYLKIXWFUE", cchLength=0x14 | out: lpsz="AMQDEPVGRFKYLKIXWFUE") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="AMQDEPVGRFKYLKIXWFUE", cchLength=0x14 | out: lpsz="AMQDEPVGRFKYLKIXWFUE") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="DRWKLTSFSUYKEYGFYHQD", cchLength=0x14 | out: lpsz="DRWKLTSFSUYKEYGFYHQD") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="DRWKLTSFSUYKEYGFYHQD", cchLength=0x14 | out: lpsz="DRWKLTSFSUYKEYGFYHQD") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="ABKWPVNUENAVQACYEFTI", cchLength=0x14 | out: lpsz="ABKWPVNUENAVQACYEFTI") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="ABKWPVNUENAVQACYEFTI", cchLength=0x14 | out: lpsz="ABKWPVNUENAVQACYEFTI") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="SYOGJLMMAYDLTM_CJKEP", cchLength=0x14 | out: lpsz="SYOGJLMMAYDLTM_CJKEP") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="SYOGJLMMAYDLTM_CJKEP", cchLength=0x14 | out: lpsz="SYOGJLMMAYDLTM_CJKEP") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="OMEBTERIXFCYORJVKGTE", cchLength=0x14 | out: lpsz="OMEBTERIXFCYORJVKGTE") returned 0x14 [0082.999] CharUpperBuffW (in: lpsz="OMEBTERIXFCYORJVKGTE", cchLength=0x14 | out: lpsz="OMEBTERIXFCYORJVKGTE") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="KNNAIYDHZSRCVRFNBHZF", cchLength=0x14 | out: lpsz="KNNAIYDHZSRCVRFNBHZF") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="KNNAIYDHZSRCVRFNBHZF", cchLength=0x14 | out: lpsz="KNNAIYDHZSRCVRFNBHZF") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="NRFRBMZPG_SQYOMMIAEX", cchLength=0x14 | out: lpsz="NRFRBMZPG_SQYOMMIAEX") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="NRFRBMZPG_SQYOMMIAEX", cchLength=0x14 | out: lpsz="NRFRBMZPG_SQYOMMIAEX") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="TSQDPVNBMYTZDXESMLES", cchLength=0x14 | out: lpsz="TSQDPVNBMYTZDXESMLES") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="TSQDPVNBMYTZDXESMLES", cchLength=0x14 | out: lpsz="TSQDPVNBMYTZDXESMLES") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="FEWPTOBLLJCUJEHHYGLG", cchLength=0x14 | out: lpsz="FEWPTOBLLJCUJEHHYGLG") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="FEWPTOBLLJCUJEHHYGLG", cchLength=0x14 | out: lpsz="FEWPTOBLLJCUJEHHYGLG") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="US_RIYBUCILKFUWUWEDU", cchLength=0x14 | out: lpsz="US_RIYBUCILKFUWUWEDU") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="US_RIYBUCILKFUWUWEDU", cchLength=0x14 | out: lpsz="US_RIYBUCILKFUWUWEDU") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="XFSWTCXAHIIWJXZLMYPY", cchLength=0x14 | out: lpsz="XFSWTCXAHIIWJXZLMYPY") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="XFSWTCXAHIIWJXZLMYPY", cchLength=0x14 | out: lpsz="XFSWTCXAHIIWJXZLMYPY") returned 0x14 [0083.000] CharUpperBuffW (in: lpsz="WONTCZUQCNZAUJHELSBO", cchLength=0x14 | out: lpsz="WONTCZUQCNZAUJHELSBO") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="WONTCZUQCNZAUJHELSBO", cchLength=0x14 | out: lpsz="WONTCZUQCNZAUJHELSBO") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="JFTVYKADTXOLYOSYZOAY", cchLength=0x14 | out: lpsz="JFTVYKADTXOLYOSYZOAY") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="JFTVYKADTXOLYOSYZOAY", cchLength=0x14 | out: lpsz="JFTVYKADTXOLYOSYZOAY") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="NPEGDBGBJXFHDYAVULHL", cchLength=0x14 | out: lpsz="NPEGDBGBJXFHDYAVULHL") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="NPEGDBGBJXFHDYAVULHL", cchLength=0x14 | out: lpsz="NPEGDBGBJXFHDYAVULHL") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="RTVNJRJDKSCKHKDVEEKZ", cchLength=0x14 | out: lpsz="RTVNJRJDKSCKHKDVEEKZ") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="RTVNJRJDKSCKHKDVEEKZ", cchLength=0x14 | out: lpsz="RTVNJRJDKSCKHKDVEEKZ") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0083.001] CharUpperBuffW (in: lpsz="NGR_RGYWLIRLFAYSHHJK", cchLength=0x14 | out: lpsz="NGR_RGYWLIRLFAYSHHJK") returned 0x14 [0083.002] CharUpperBuffW (in: lpsz="NGR_RGYWLIRLFAYSHHJK", cchLength=0x14 | out: lpsz="NGR_RGYWLIRLFAYSHHJK") returned 0x14 [0083.002] CharUpperBuffW (in: lpsz="IDXQIICQQWKNZSJCQWXO", cchLength=0x14 | out: lpsz="IDXQIICQQWKNZSJCQWXO") returned 0x14 [0083.002] CharUpperBuffW (in: lpsz="IDXQIICQQWKNZSJCQWXO", cchLength=0x14 | out: lpsz="IDXQIICQQWKNZSJCQWXO") returned 0x14 [0083.002] CharUpperBuffW (in: lpsz="CGLYSV_VMJRNJJTCLUXS", cchLength=0x14 | out: lpsz="CGLYSV_VMJRNJJTCLUXS") returned 0x14 [0083.002] CharUpperBuffW (in: lpsz="CGLYSV_VMJRNJJTCLUXS", cchLength=0x14 | out: lpsz="CGLYSV_VMJRNJJTCLUXS") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="PRWRLUFYJZWBMKYOBTGF", cchLength=0x14 | out: lpsz="PRWRLUFYJZWBMKYOBTGF") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="PRWRLUFYJZWBMKYOBTGF", cchLength=0x14 | out: lpsz="PRWRLUFYJZWBMKYOBTGF") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="BBUTKNHPRBELTCKQDMXZ", cchLength=0x14 | out: lpsz="BBUTKNHPRBELTCKQDMXZ") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="BBUTKNHPRBELTCKQDMXZ", cchLength=0x14 | out: lpsz="BBUTKNHPRBELTCKQDMXZ") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="JKCXJTLZTATLTKCPGXKH", cchLength=0x14 | out: lpsz="JKCXJTLZTATLTKCPGXKH") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="JKCXJTLZTATLTKCPGXKH", cchLength=0x14 | out: lpsz="JKCXJTLZTATLTKCPGXKH") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="AJYEZDTNOSNQTTEIRRTN", cchLength=0x14 | out: lpsz="AJYEZDTNOSNQTTEIRRTN") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="AJYEZDTNOSNQTTEIRRTN", cchLength=0x14 | out: lpsz="AJYEZDTNOSNQTTEIRRTN") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="SKIRTGLRHOFWUQUUQYOD", cchLength=0x14 | out: lpsz="SKIRTGLRHOFWUQUUQYOD") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="SKIRTGLRHOFWUQUUQYOD", cchLength=0x14 | out: lpsz="SKIRTGLRHOFWUQUUQYOD") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="DOJZUHTZAPEIUCYQV_CH", cchLength=0x14 | out: lpsz="DOJZUHTZAPEIUCYQV_CH") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="DOJZUHTZAPEIUCYQV_CH", cchLength=0x14 | out: lpsz="DOJZUHTZAPEIUCYQV_CH") returned 0x14 [0083.003] CharUpperBuffW (in: lpsz="SLAEVLLOVSIVJBMMHQKE", cchLength=0x14 | out: lpsz="SLAEVLLOVSIVJBMMHQKE") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="SLAEVLLOVSIVJBMMHQKE", cchLength=0x14 | out: lpsz="SLAEVLLOVSIVJBMMHQKE") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="QVYQNDKGWIKKRWKKWVCQ", cchLength=0x14 | out: lpsz="QVYQNDKGWIKKRWKKWVCQ") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="QVYQNDKGWIKKRWKKWVCQ", cchLength=0x14 | out: lpsz="QVYQNDKGWIKKRWKKWVCQ") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="TVASIEJUTJGCLNMPNKIN", cchLength=0x14 | out: lpsz="TVASIEJUTJGCLNMPNKIN") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="TVASIEJUTJGCLNMPNKIN", cchLength=0x14 | out: lpsz="TVASIEJUTJGCLNMPNKIN") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="HMWMNGSESHZNGI_ZJEMP", cchLength=0x14 | out: lpsz="HMWMNGSESHZNGI_ZJEMP") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="HMWMNGSESHZNGI_ZJEMP", cchLength=0x14 | out: lpsz="HMWMNGSESHZNGI_ZJEMP") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="TWHBKZQUTRXCNIMBHLCT", cchLength=0x14 | out: lpsz="TWHBKZQUTRXCNIMBHLCT") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="TWHBKZQUTRXCNIMBHLCT", cchLength=0x14 | out: lpsz="TWHBKZQUTRXCNIMBHLCT") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="MRXYVNNENBQFMGDBQGGV", cchLength=0x14 | out: lpsz="MRXYVNNENBQFMGDBQGGV") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="MRXYVNNENBQFMGDBQGGV", cchLength=0x14 | out: lpsz="MRXYVNNENBQFMGDBQGGV") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="HFOVTLOBFNGEQMVYPBQP", cchLength=0x14 | out: lpsz="HFOVTLOBFNGEQMVYPBQP") returned 0x14 [0083.004] CharUpperBuffW (in: lpsz="HFOVTLOBFNGEQMVYPBQP", cchLength=0x14 | out: lpsz="HFOVTLOBFNGEQMVYPBQP") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="BNN_VUOZHLCAXYVQU_RM", cchLength=0x14 | out: lpsz="BNN_VUOZHLCAXYVQU_RM") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="BNN_VUOZHLCAXYVQU_RM", cchLength=0x14 | out: lpsz="BNN_VUOZHLCAXYVQU_RM") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="GVMPCHVLDBPFGUDVAUTI", cchLength=0x14 | out: lpsz="GVMPCHVLDBPFGUDVAUTI") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="GVMPCHVLDBPFGUDVAUTI", cchLength=0x14 | out: lpsz="GVMPCHVLDBPFGUDVAUTI") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="KVYQGTPSRIDKXHOSWNFL", cchLength=0x14 | out: lpsz="KVYQGTPSRIDKXHOSWNFL") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="KVYQGTPSRIDKXHOSWNFL", cchLength=0x14 | out: lpsz="KVYQGTPSRIDKXHOSWNFL") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="XWIXBQLSBNHDNALKQPYB", cchLength=0x14 | out: lpsz="XWIXBQLSBNHDNALKQPYB") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="XWIXBQLSBNHDNALKQPYB", cchLength=0x14 | out: lpsz="XWIXBQLSBNHDNALKQPYB") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="CAWVRYLMUYYELQKYLUDR", cchLength=0x14 | out: lpsz="CAWVRYLMUYYELQKYLUDR") returned 0x14 [0083.005] CharUpperBuffW (in: lpsz="CAWVRYLMUYYELQKYLUDR", cchLength=0x14 | out: lpsz="CAWVRYLMUYYELQKYLUDR") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="VCPXMGLIKRBTBLYCJMWW", cchLength=0x14 | out: lpsz="VCPXMGLIKRBTBLYCJMWW") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="VCPXMGLIKRBTBLYCJMWW", cchLength=0x14 | out: lpsz="VCPXMGLIKRBTBLYCJMWW") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="FKJPNAAULJEYFTJHPGRM", cchLength=0x14 | out: lpsz="FKJPNAAULJEYFTJHPGRM") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="FKJPNAAULJEYFTJHPGRM", cchLength=0x14 | out: lpsz="FKJPNAAULJEYFTJHPGRM") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="MMBKMWVJWOGCINWBGHEI", cchLength=0x14 | out: lpsz="MMBKMWVJWOGCINWBGHEI") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="MMBKMWVJWOGCINWBGHEI", cchLength=0x14 | out: lpsz="MMBKMWVJWOGCINWBGHEI") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="DVDMT_BXXKBFCCNTFGFO", cchLength=0x14 | out: lpsz="DVDMT_BXXKBFCCNTFGFO") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="DVDMT_BXXKBFCCNTFGFO", cchLength=0x14 | out: lpsz="DVDMT_BXXKBFCCNTFGFO") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="TEQWXYVQXQTHQMKGBQMX", cchLength=0x14 | out: lpsz="TEQWXYVQXQTHQMKGBQMX") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="TEQWXYVQXQTHQMKGBQMX", cchLength=0x14 | out: lpsz="TEQWXYVQXQTHQMKGBQMX") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="IGRXWNKNIDHAGDSCOBSK", cchLength=0x14 | out: lpsz="IGRXWNKNIDHAGDSCOBSK") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="IGRXWNKNIDHAGDSCOBSK", cchLength=0x14 | out: lpsz="IGRXWNKNIDHAGDSCOBSK") returned 0x14 [0083.006] CharUpperBuffW (in: lpsz="_KGEVVOZKJJCBGPELJNU", cchLength=0x14 | out: lpsz="_KGEVVOZKJJCBGPELJNU") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="_KGEVVOZKJJCBGPELJNU", cchLength=0x14 | out: lpsz="_KGEVVOZKJJCBGPELJNU") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="HFUNAXNYPKNZPOOJBABT", cchLength=0x14 | out: lpsz="HFUNAXNYPKNZPOOJBABT") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="HFUNAXNYPKNZPOOJBABT", cchLength=0x14 | out: lpsz="HFUNAXNYPKNZPOOJBABT") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="TBIVCLBIASJGMYPGPNKM", cchLength=0x14 | out: lpsz="TBIVCLBIASJGMYPGPNKM") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="TBIVCLBIASJGMYPGPNKM", cchLength=0x14 | out: lpsz="TBIVCLBIASJGMYPGPNKM") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="A_VGOSHEMIF_YFFLAXBE", cchLength=0x14 | out: lpsz="A_VGOSHEMIF_YFFLAXBE") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="A_VGOSHEMIF_YFFLAXBE", cchLength=0x14 | out: lpsz="A_VGOSHEMIF_YFFLAXBE") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="HJMKOMUFBVOESN_YGRAC", cchLength=0x14 | out: lpsz="HJMKOMUFBVOESN_YGRAC") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="HJMKOMUFBVOESN_YGRAC", cchLength=0x14 | out: lpsz="HJMKOMUFBVOESN_YGRAC") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="JISUMVPOAZL_JLZATLNM", cchLength=0x14 | out: lpsz="JISUMVPOAZL_JLZATLNM") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="JISUMVPOAZL_JLZATLNM", cchLength=0x14 | out: lpsz="JISUMVPOAZL_JLZATLNM") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="FAMPZFRNGXLXBSAJXLZA", cchLength=0x14 | out: lpsz="FAMPZFRNGXLXBSAJXLZA") returned 0x14 [0083.007] CharUpperBuffW (in: lpsz="FAMPZFRNGXLXBSAJXLZA", cchLength=0x14 | out: lpsz="FAMPZFRNGXLXBSAJXLZA") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="ECKMEMCHDOSIWWCIKFWC", cchLength=0x14 | out: lpsz="ECKMEMCHDOSIWWCIKFWC") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="ECKMEMCHDOSIWWCIKFWC", cchLength=0x14 | out: lpsz="ECKMEMCHDOSIWWCIKFWC") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="_ZCGFXBMZNQJPDKODWUI", cchLength=0x14 | out: lpsz="_ZCGFXBMZNQJPDKODWUI") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="_ZCGFXBMZNQJPDKODWUI", cchLength=0x14 | out: lpsz="_ZCGFXBMZNQJPDKODWUI") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="IFVTRKLQDVXTCMCDWCMI", cchLength=0x14 | out: lpsz="IFVTRKLQDVXTCMCDWCMI") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="IFVTRKLQDVXTCMCDWCMI", cchLength=0x14 | out: lpsz="IFVTRKLQDVXTCMCDWCMI") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="FT__FJXV_ONADYQWZRHW", cchLength=0x14 | out: lpsz="FT__FJXV_ONADYQWZRHW") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="FT__FJXV_ONADYQWZRHW", cchLength=0x14 | out: lpsz="FT__FJXV_ONADYQWZRHW") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="DTJCJZRYGGJJHVBBUMJG", cchLength=0x14 | out: lpsz="DTJCJZRYGGJJHVBBUMJG") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="DTJCJZRYGGJJHVBBUMJG", cchLength=0x14 | out: lpsz="DTJCJZRYGGJJHVBBUMJG") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="QHGOOPWKGUOHQKVYDYES", cchLength=0x14 | out: lpsz="QHGOOPWKGUOHQKVYDYES") returned 0x14 [0083.008] CharUpperBuffW (in: lpsz="QHGOOPWKGUOHQKVYDYES", cchLength=0x14 | out: lpsz="QHGOOPWKGUOHQKVYDYES") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="URONHQRVNUBWEATGZUFO", cchLength=0x14 | out: lpsz="URONHQRVNUBWEATGZUFO") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="URONHQRVNUBWEATGZUFO", cchLength=0x14 | out: lpsz="URONHQRVNUBWEATGZUFO") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="DBYPH_KLVNBRGDXOHVKO", cchLength=0x14 | out: lpsz="DBYPH_KLVNBRGDXOHVKO") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="DBYPH_KLVNBRGDXOHVKO", cchLength=0x14 | out: lpsz="DBYPH_KLVNBRGDXOHVKO") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="ZGGVWCXEDJQTJHMNMJGB", cchLength=0x14 | out: lpsz="ZGGVWCXEDJQTJHMNMJGB") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="ZGGVWCXEDJQTJHMNMJGB", cchLength=0x14 | out: lpsz="ZGGVWCXEDJQTJHMNMJGB") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="WHTIBXLOOYEPETOZJYJH", cchLength=0x14 | out: lpsz="WHTIBXLOOYEPETOZJYJH") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="WHTIBXLOOYEPETOZJYJH", cchLength=0x14 | out: lpsz="WHTIBXLOOYEPETOZJYJH") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="RNHUIJIZWMJYXGFIAAUL", cchLength=0x14 | out: lpsz="RNHUIJIZWMJYXGFIAAUL") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="RNHUIJIZWMJYXGFIAAUL", cchLength=0x14 | out: lpsz="RNHUIJIZWMJYXGFIAAUL") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="EKVVREXDQUCG_SJXBEUS", cchLength=0x14 | out: lpsz="EKVVREXDQUCG_SJXBEUS") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="EKVVREXDQUCG_SJXBEUS", cchLength=0x14 | out: lpsz="EKVVREXDQUCG_SJXBEUS") returned 0x14 [0083.009] CharUpperBuffW (in: lpsz="IHBMLZTZASLWWBHCNKKY", cchLength=0x14 | out: lpsz="IHBMLZTZASLWWBHCNKKY") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="IHBMLZTZASLWWBHCNKKY", cchLength=0x14 | out: lpsz="IHBMLZTZASLWWBHCNKKY") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="NUDYADCXLRRSMFYNGQNQ", cchLength=0x14 | out: lpsz="NUDYADCXLRRSMFYNGQNQ") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="NUDYADCXLRRSMFYNGQNQ", cchLength=0x14 | out: lpsz="NUDYADCXLRRSMFYNGQNQ") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="OVNRMJFAAVMIPXZPPROB", cchLength=0x14 | out: lpsz="OVNRMJFAAVMIPXZPPROB") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="OVNRMJFAAVMIPXZPPROB", cchLength=0x14 | out: lpsz="OVNRMJFAAVMIPXZPPROB") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="BJLMTQLGRGTBWCILKCIQ", cchLength=0x14 | out: lpsz="BJLMTQLGRGTBWCILKCIQ") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="BJLMTQLGRGTBWCILKCIQ", cchLength=0x14 | out: lpsz="BJLMTQLGRGTBWCILKCIQ") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="NVVLEDLWQZQCMBOKPSCF", cchLength=0x14 | out: lpsz="NVVLEDLWQZQCMBOKPSCF") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="NVVLEDLWQZQCMBOKPSCF", cchLength=0x14 | out: lpsz="NVVLEDLWQZQCMBOKPSCF") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="FMZXLSJHHMLTZENDAMYM", cchLength=0x14 | out: lpsz="FMZXLSJHHMLTZENDAMYM") returned 0x14 [0083.010] CharUpperBuffW (in: lpsz="FMZXLSJHHMLTZENDAMYM", cchLength=0x14 | out: lpsz="FMZXLSJHHMLTZENDAMYM") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="SPUTZWGLDAULZAFTWXZV", cchLength=0x14 | out: lpsz="SPUTZWGLDAULZAFTWXZV") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="SPUTZWGLDAULZAFTWXZV", cchLength=0x14 | out: lpsz="SPUTZWGLDAULZAFTWXZV") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="GOQEEHSMEPRUOBDQKWUP", cchLength=0x14 | out: lpsz="GOQEEHSMEPRUOBDQKWUP") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="GOQEEHSMEPRUOBDQKWUP", cchLength=0x14 | out: lpsz="GOQEEHSMEPRUOBDQKWUP") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="ATLRFHDEHDMGFCQ_MXHD", cchLength=0x14 | out: lpsz="ATLRFHDEHDMGFCQ_MXHD") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="ATLRFHDEHDMGFCQ_MXHD", cchLength=0x14 | out: lpsz="ATLRFHDEHDMGFCQ_MXHD") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="FBNVQRDBUQMRSQUPZEVG", cchLength=0x14 | out: lpsz="FBNVQRDBUQMRSQUPZEVG") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="FBNVQRDBUQMRSQUPZEVG", cchLength=0x14 | out: lpsz="FBNVQRDBUQMRSQUPZEVG") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="WKOWRNRO___TIJZXLUIE", cchLength=0x14 | out: lpsz="WKOWRNRO___TIJZXLUIE") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="WKOWRNRO___TIJZXLUIE", cchLength=0x14 | out: lpsz="WKOWRNRO___TIJZXLUIE") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="KVOVOTDOKRIIMWHEBHMB", cchLength=0x14 | out: lpsz="KVOVOTDOKRIIMWHEBHMB") returned 0x14 [0083.011] CharUpperBuffW (in: lpsz="KVOVOTDOKRIIMWHEBHMB", cchLength=0x14 | out: lpsz="KVOVOTDOKRIIMWHEBHMB") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="HLIQSXOUCNXEAZCUXEBS", cchLength=0x14 | out: lpsz="HLIQSXOUCNXEAZCUXEBS") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="HLIQSXOUCNXEAZCUXEBS", cchLength=0x14 | out: lpsz="HLIQSXOUCNXEAZCUXEBS") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="TGW_L_HZLDXGZPZIRJYY", cchLength=0x14 | out: lpsz="TGW_L_HZLDXGZPZIRJYY") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="TGW_L_HZLDXGZPZIRJYY", cchLength=0x14 | out: lpsz="TGW_L_HZLDXGZPZIRJYY") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="PHJZQBHGBLSQFJXCPK_M", cchLength=0x14 | out: lpsz="PHJZQBHGBLSQFJXCPK_M") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="PHJZQBHGBLSQFJXCPK_M", cchLength=0x14 | out: lpsz="PHJZQBHGBLSQFJXCPK_M") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="VTPMSRTXCOOHOKDAOXEH", cchLength=0x14 | out: lpsz="VTPMSRTXCOOHOKDAOXEH") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="VTPMSRTXCOOHOKDAOXEH", cchLength=0x14 | out: lpsz="VTPMSRTXCOOHOKDAOXEH") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="EBHLYPIUKAVZA_OGNFLT", cchLength=0x14 | out: lpsz="EBHLYPIUKAVZA_OGNFLT") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="EBHLYPIUKAVZA_OGNFLT", cchLength=0x14 | out: lpsz="EBHLYPIUKAVZA_OGNFLT") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.012] CharUpperBuffW (in: lpsz="PTIWEOWEASVD_VCSIPFW", cchLength=0x14 | out: lpsz="PTIWEOWEASVD_VCSIPFW") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="PTIWEOWEASVD_VCSIPFW", cchLength=0x14 | out: lpsz="PTIWEOWEASVD_VCSIPFW") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="_MIJJBAKZIYTPWIRUNSM", cchLength=0x14 | out: lpsz="_MIJJBAKZIYTPWIRUNSM") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="_MIJJBAKZIYTPWIRUNSM", cchLength=0x14 | out: lpsz="_MIJJBAKZIYTPWIRUNSM") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="ISXEVJELOZPMFPUUWN_M", cchLength=0x14 | out: lpsz="ISXEVJELOZPMFPUUWN_M") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="ISXEVJELOZPMFPUUWN_M", cchLength=0x14 | out: lpsz="ISXEVJELOZPMFPUUWN_M") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="NUUVN_ACCRGZTONJQDDN", cchLength=0x14 | out: lpsz="NUUVN_ACCRGZTONJQDDN") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="NUUVN_ACCRGZTONJQDDN", cchLength=0x14 | out: lpsz="NUUVN_ACCRGZTONJQDDN") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="MPUHLDKUBDWWLTDIERUE", cchLength=0x14 | out: lpsz="MPUHLDKUBDWWLTDIERUE") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="MPUHLDKUBDWWLTDIERUE", cchLength=0x14 | out: lpsz="MPUHLDKUBDWWLTDIERUE") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="KPEAKNKTUNERIHXLHQPR", cchLength=0x14 | out: lpsz="KPEAKNKTUNERIHXLHQPR") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="KPEAKNKTUNERIHXLHQPR", cchLength=0x14 | out: lpsz="KPEAKNKTUNERIHXLHQPR") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0083.013] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="YHPSZRIJQJDLOVRNSRMY", cchLength=0x14 | out: lpsz="YHPSZRIJQJDLOVRNSRMY") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="YHPSZRIJQJDLOVRNSRMY", cchLength=0x14 | out: lpsz="YHPSZRIJQJDLOVRNSRMY") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="YYKFZMEHTHMRTTIZAYIK", cchLength=0x14 | out: lpsz="YYKFZMEHTHMRTTIZAYIK") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="YYKFZMEHTHMRTTIZAYIK", cchLength=0x14 | out: lpsz="YYKFZMEHTHMRTTIZAYIK") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="XLLSVSFYSDLDRRVKAWOL", cchLength=0x14 | out: lpsz="XLLSVSFYSDLDRRVKAWOL") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="XLLSVSFYSDLDRRVKAWOL", cchLength=0x14 | out: lpsz="XLLSVSFYSDLDRRVKAWOL") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="OCZOSOO_VZBANTXFMYTA", cchLength=0x14 | out: lpsz="OCZOSOO_VZBANTXFMYTA") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="OCZOSOO_VZBANTXFMYTA", cchLength=0x14 | out: lpsz="OCZOSOO_VZBANTXFMYTA") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="RNVFZJYOJHYGNWHJITMW", cchLength=0x14 | out: lpsz="RNVFZJYOJHYGNWHJITMW") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="RNVFZJYOJHYGNWHJITMW", cchLength=0x14 | out: lpsz="RNVFZJYOJHYGNWHJITMW") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="AOBCXARUGBAVBBAVHCGC", cchLength=0x14 | out: lpsz="AOBCXARUGBAVBBAVHCGC") returned 0x14 [0083.014] CharUpperBuffW (in: lpsz="AOBCXARUGBAVBBAVHCGC", cchLength=0x14 | out: lpsz="AOBCXARUGBAVBBAVHCGC") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="Q_LFLBOXJUIHZMESROBD", cchLength=0x14 | out: lpsz="Q_LFLBOXJUIHZMESROBD") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="Q_LFLBOXJUIHZMESROBD", cchLength=0x14 | out: lpsz="Q_LFLBOXJUIHZMESROBD") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="DIRCGVCYOUQJGIAZYVGM", cchLength=0x14 | out: lpsz="DIRCGVCYOUQJGIAZYVGM") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="DIRCGVCYOUQJGIAZYVGM", cchLength=0x14 | out: lpsz="DIRCGVCYOUQJGIAZYVGM") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="JOJZCHXEYSELNQUOZTIM", cchLength=0x14 | out: lpsz="JOJZCHXEYSELNQUOZTIM") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="JOJZCHXEYSELNQUOZTIM", cchLength=0x14 | out: lpsz="JOJZCHXEYSELNQUOZTIM") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="ZXL_EVRZLHUQLQPMJKXE", cchLength=0x14 | out: lpsz="ZXL_EVRZLHUQLQPMJKXE") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="ZXL_EVRZLHUQLQPMJKXE", cchLength=0x14 | out: lpsz="ZXL_EVRZLHUQLQPMJKXE") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="DLAAVYZCQGXMSOLNZMZB", cchLength=0x14 | out: lpsz="DLAAVYZCQGXMSOLNZMZB") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="DLAAVYZCQGXMSOLNZMZB", cchLength=0x14 | out: lpsz="DLAAVYZCQGXMSOLNZMZB") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="ZYPUBSLFSVZSLWIQEIDR", cchLength=0x14 | out: lpsz="ZYPUBSLFSVZSLWIQEIDR") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="ZYPUBSLFSVZSLWIQEIDR", cchLength=0x14 | out: lpsz="ZYPUBSLFSVZSLWIQEIDR") returned 0x14 [0083.015] CharUpperBuffW (in: lpsz="BSBAWZNDNTYYFU_IBHZS", cchLength=0x14 | out: lpsz="BSBAWZNDNTYYFU_IBHZS") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="BSBAWZNDNTYYFU_IBHZS", cchLength=0x14 | out: lpsz="BSBAWZNDNTYYFU_IBHZS") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="LQVDQPQEOBAKVEZUEERG", cchLength=0x14 | out: lpsz="LQVDQPQEOBAKVEZUEERG") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="LQVDQPQEOBAKVEZUEERG", cchLength=0x14 | out: lpsz="LQVDQPQEOBAKVEZUEERG") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="ZNQMQJYARTCFEMTWJIHR", cchLength=0x14 | out: lpsz="ZNQMQJYARTCFEMTWJIHR") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="ZNQMQJYARTCFEMTWJIHR", cchLength=0x14 | out: lpsz="ZNQMQJYARTCFEMTWJIHR") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="FLDM_QGWQIEKXWDTBRDB", cchLength=0x14 | out: lpsz="FLDM_QGWQIEKXWDTBRDB") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="FLDM_QGWQIEKXWDTBRDB", cchLength=0x14 | out: lpsz="FLDM_QGWQIEKXWDTBRDB") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="QEFZWQPGSAHIFLGQVXV_", cchLength=0x14 | out: lpsz="QEFZWQPGSAHIFLGQVXV_") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="QEFZWQPGSAHIFLGQVXV_", cchLength=0x14 | out: lpsz="QEFZWQPGSAHIFLGQVXV_") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="HSLWTF_FMHKWUUJGRQPF", cchLength=0x14 | out: lpsz="HSLWTF_FMHKWUUJGRQPF") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="HSLWTF_FMHKWUUJGRQPF", cchLength=0x14 | out: lpsz="HSLWTF_FMHKWUUJGRQPF") returned 0x14 [0083.016] CharUpperBuffW (in: lpsz="ADJGKGMBRAQZFE_WYFMC", cchLength=0x14 | out: lpsz="ADJGKGMBRAQZFE_WYFMC") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="ADJGKGMBRAQZFE_WYFMC", cchLength=0x14 | out: lpsz="ADJGKGMBRAQZFE_WYFMC") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="RHKCGUIZTHACOFKJWGPY", cchLength=0x14 | out: lpsz="RHKCGUIZTHACOFKJWGPY") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="RHKCGUIZTHACOFKJWGPY", cchLength=0x14 | out: lpsz="RHKCGUIZTHACOFKJWGPY") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="XALBCOZOUUDGAIXIQMWV", cchLength=0x14 | out: lpsz="XALBCOZOUUDGAIXIQMWV") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="XALBCOZOUUDGAIXIQMWV", cchLength=0x14 | out: lpsz="XALBCOZOUUDGAIXIQMWV") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="TE__JWNSXGEHGPPFMNCK", cchLength=0x14 | out: lpsz="TE__JWNSXGEHGPPFMNCK") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="TE__JWNSXGEHGPPFMNCK", cchLength=0x14 | out: lpsz="TE__JWNSXGEHGPPFMNCK") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="NTJQCSZDHNUWDALIU_JH", cchLength=0x14 | out: lpsz="NTJQCSZDHNUWDALIU_JH") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="NTJQCSZDHNUWDALIU_JH", cchLength=0x14 | out: lpsz="NTJQCSZDHNUWDALIU_JH") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="EOFPISWVZELPYTRELMNQ", cchLength=0x14 | out: lpsz="EOFPISWVZELPYTRELMNQ") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="EOFPISWVZELPYTRELMNQ", cchLength=0x14 | out: lpsz="EOFPISWVZELPYTRELMNQ") returned 0x14 [0083.017] CharUpperBuffW (in: lpsz="DFUSZUZNKUVVAQ_OOESL", cchLength=0x14 | out: lpsz="DFUSZUZNKUVVAQ_OOESL") returned 0x14 [0083.018] CharUpperBuffW (in: lpsz="DFUSZUZNKUVVAQ_OOESL", cchLength=0x14 | out: lpsz="DFUSZUZNKUVVAQ_OOESL") returned 0x14 [0083.018] CharUpperBuffW (in: lpsz="HQGJHNQBJP_BLS_VUEPT", cchLength=0x14 | out: lpsz="HQGJHNQBJP_BLS_VUEPT") returned 0x14 [0083.018] CharUpperBuffW (in: lpsz="HQGJHNQBJP_BLS_VUEPT", cchLength=0x14 | out: lpsz="HQGJHNQBJP_BLS_VUEPT") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="IXJEARQUQLJKDRZVETNC", cchLength=0x14 | out: lpsz="IXJEARQUQLJKDRZVETNC") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="IXJEARQUQLJKDRZVETNC", cchLength=0x14 | out: lpsz="IXJEARQUQLJKDRZVETNC") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="R_HXSMTQHZMLOY_OVNVQ", cchLength=0x14 | out: lpsz="R_HXSMTQHZMLOY_OVNVQ") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="R_HXSMTQHZMLOY_OVNVQ", cchLength=0x14 | out: lpsz="R_HXSMTQHZMLOY_OVNVQ") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="IOWEKEVXKVBSQYBFFHAC", cchLength=0x14 | out: lpsz="IOWEKEVXKVBSQYBFFHAC") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="IOWEKEVXKVBSQYBFFHAC", cchLength=0x14 | out: lpsz="IOWEKEVXKVBSQYBFFHAC") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="ZWVOLVHCXTTABYIH_QIK", cchLength=0x14 | out: lpsz="ZWVOLVHCXTTABYIH_QIK") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="ZWVOLVHCXTTABYIH_QIK", cchLength=0x14 | out: lpsz="ZWVOLVHCXTTABYIH_QIK") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="YGZNUTVLBTUIUMORDGXG", cchLength=0x14 | out: lpsz="YGZNUTVLBTUIUMORDGXG") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="YGZNUTVLBTUIUMORDGXG", cchLength=0x14 | out: lpsz="YGZNUTVLBTUIUMORDGXG") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="YCOQJF_WCPMLCUJOZPEM", cchLength=0x14 | out: lpsz="YCOQJF_WCPMLCUJOZPEM") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="YCOQJF_WCPMLCUJOZPEM", cchLength=0x14 | out: lpsz="YCOQJF_WCPMLCUJOZPEM") returned 0x14 [0083.019] CharUpperBuffW (in: lpsz="PBCXQ_NYSQLKXTQ_MXRH", cchLength=0x14 | out: lpsz="PBCXQ_NYSQLKXTQ_MXRH") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="PBCXQ_NYSQLKXTQ_MXRH", cchLength=0x14 | out: lpsz="PBCXQ_NYSQLKXTQ_MXRH") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="GTQVUATOAAGUKZQXRXAS", cchLength=0x14 | out: lpsz="GTQVUATOAAGUKZQXRXAS") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="GTQVUATOAAGUKZQXRXAS", cchLength=0x14 | out: lpsz="GTQVUATOAAGUKZQXRXAS") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="YBURDCYGDWATQEEEPMID", cchLength=0x14 | out: lpsz="YBURDCYGDWATQEEEPMID") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="YBURDCYGDWATQEEEPMID", cchLength=0x14 | out: lpsz="YBURDCYGDWATQEEEPMID") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="LVHRFAHBOPRTUFPMRKFA", cchLength=0x14 | out: lpsz="LVHRFAHBOPRTUFPMRKFA") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="LVHRFAHBOPRTUFPMRKFA", cchLength=0x14 | out: lpsz="LVHRFAHBOPRTUFPMRKFA") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="VPMTSGRTYAWJBNTCAFQV", cchLength=0x14 | out: lpsz="VPMTSGRTYAWJBNTCAFQV") returned 0x14 [0083.020] CharUpperBuffW (in: lpsz="VPMTSGRTYAWJBNTCAFQV", cchLength=0x14 | out: lpsz="VPMTSGRTYAWJBNTCAFQV") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="SPPTUPHEFIFRPFIUJWPE", cchLength=0x14 | out: lpsz="SPPTUPHEFIFRPFIUJWPE") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="SPPTUPHEFIFRPFIUJWPE", cchLength=0x14 | out: lpsz="SPPTUPHEFIFRPFIUJWPE") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="YHDHNWJXFYSBOTMCLCCK", cchLength=0x14 | out: lpsz="YHDHNWJXFYSBOTMCLCCK") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="YHDHNWJXFYSBOTMCLCCK", cchLength=0x14 | out: lpsz="YHDHNWJXFYSBOTMCLCCK") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="HBCXYPGZJYUIEUOFONZL", cchLength=0x14 | out: lpsz="HBCXYPGZJYUIEUOFONZL") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="HBCXYPGZJYUIEUOFONZL", cchLength=0x14 | out: lpsz="HBCXYPGZJYUIEUOFONZL") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="KMFBYHCLQKWBVOTTPPUI", cchLength=0x14 | out: lpsz="KMFBYHCLQKWBVOTTPPUI") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="KMFBYHCLQKWBVOTTPPUI", cchLength=0x14 | out: lpsz="KMFBYHCLQKWBVOTTPPUI") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="NPMWIEBZ_ZJZDZJGPRCB", cchLength=0x14 | out: lpsz="NPMWIEBZ_ZJZDZJGPRCB") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="NPMWIEBZ_ZJZDZJGPRCB", cchLength=0x14 | out: lpsz="NPMWIEBZ_ZJZDZJGPRCB") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="FHAKUYOMQHQPYRQEESDU", cchLength=0x14 | out: lpsz="FHAKUYOMQHQPYRQEESDU") returned 0x14 [0083.021] CharUpperBuffW (in: lpsz="FHAKUYOMQHQPYRQEESDU", cchLength=0x14 | out: lpsz="FHAKUYOMQHQPYRQEESDU") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="FGFFXQKHKEKMQEASRIFD", cchLength=0x14 | out: lpsz="FGFFXQKHKEKMQEASRIFD") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="FGFFXQKHKEKMQEASRIFD", cchLength=0x14 | out: lpsz="FGFFXQKHKEKMQEASRIFD") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="LJWSHLJQLYCSCLLVIZWX", cchLength=0x14 | out: lpsz="LJWSHLJQLYCSCLLVIZWX") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="LJWSHLJQLYCSCLLVIZWX", cchLength=0x14 | out: lpsz="LJWSHLJQLYCSCLLVIZWX") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="LMGXO__VIDUBLBNQ_URO", cchLength=0x14 | out: lpsz="LMGXO__VIDUBLBNQ_URO") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="LMGXO__VIDUBLBNQ_URO", cchLength=0x14 | out: lpsz="LMGXO__VIDUBLBNQ_URO") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="KUJEVWMGAPXSFGHGYTMN", cchLength=0x14 | out: lpsz="KUJEVWMGAPXSFGHGYTMN") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="KUJEVWMGAPXSFGHGYTMN", cchLength=0x14 | out: lpsz="KUJEVWMGAPXSFGHGYTMN") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="ZFRTZZSAHZYYERUFUTKH", cchLength=0x14 | out: lpsz="ZFRTZZSAHZYYERUFUTKH") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="ZFRTZZSAHZYYERUFUTKH", cchLength=0x14 | out: lpsz="ZFRTZZSAHZYYERUFUTKH") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="VFTWGGPLXGJNWOXXDP_N", cchLength=0x14 | out: lpsz="VFTWGGPLXGJNWOXXDP_N") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="VFTWGGPLXGJNWOXXDP_N", cchLength=0x14 | out: lpsz="VFTWGGPLXGJNWOXXDP_N") returned 0x14 [0083.022] CharUpperBuffW (in: lpsz="QHLVF_UXMS_ZKTPJHBHM", cchLength=0x14 | out: lpsz="QHLVF_UXMS_ZKTPJHBHM") returned 0x14 [0083.023] CharUpperBuffW (in: lpsz="QHLVF_UXMS_ZKTPJHBHM", cchLength=0x14 | out: lpsz="QHLVF_UXMS_ZKTPJHBHM") returned 0x14 [0083.023] CharUpperBuffW (in: lpsz="HWIRORBETUPRHDGLYFQB", cchLength=0x14 | out: lpsz="HWIRORBETUPRHDGLYFQB") returned 0x14 [0083.023] CharUpperBuffW (in: lpsz="HWIRORBETUPRHDGLYFQB", cchLength=0x14 | out: lpsz="HWIRORBETUPRHDGLYFQB") returned 0x14 [0083.023] CharUpperBuffW (in: lpsz="VRLUIXZLYOWWWIJQNUOQ", cchLength=0x14 | out: lpsz="VRLUIXZLYOWWWIJQNUOQ") returned 0x14 [0083.025] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", nBufferLength=0x7fff, lpBuffer=0x8ff808, lpFilePart=0x90f80c | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x90f80c*="MsMpEng.exe") returned 0x5c [0083.025] GetSysColorBrush (nIndex=15) returned 0x1100059 [0083.025] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0083.025] LoadIconW (hInstance=0x230000, lpIconName=0x63) returned 0x60227 [0083.026] LoadIconW (hInstance=0x230000, lpIconName=0xa4) returned 0x0 [0083.026] LoadIconW (hInstance=0x230000, lpIconName=0xa2) returned 0x0 [0083.026] LoadImageW (hInst=0x230000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x1501d7 [0083.027] RegisterClassExW (param_1=0x90f7e4) returned 0xc1c4 [0083.027] GetSysColorBrush (nIndex=15) returned 0x1100059 [0083.027] RegisterClassExW (param_1=0x90f788) returned 0xc1c5 [0083.027] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc072 [0083.027] InitCommonControlsEx (picce=0x90f7b8) returned 1 [0083.027] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0x9adf98 [0083.028] LoadIconW (hInstance=0x230000, lpIconName=0xa9) returned 0x30207 [0083.028] ImageList_ReplaceIcon (himl=0x9adf98, i=-1, hicon=0x30207) returned 0 [0083.029] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x301e2 [0083.029] DefWindowProcW (hWnd=0x301e2, Msg=0x24, wParam=0x0, lParam=0x90f420) returned 0x0 [0083.029] DefWindowProcW (hWnd=0x301e2, Msg=0x81, wParam=0x0, lParam=0x90f400) returned 0x1 [0083.030] DefWindowProcW (hWnd=0x301e2, Msg=0x83, wParam=0x0, lParam=0x90f440) returned 0x0 [0083.032] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0083.032] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc072 [0083.032] CreatePopupMenu () returned 0x70239 [0083.033] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x301e2, hMenu=0x1, hInstance=0x230000, lpParam=0x0) returned 0x20202 [0083.040] DefWindowProcW (hWnd=0x301e2, Msg=0x210, wParam=0x10001, lParam=0x20202) returned 0x0 [0083.040] ShowWindow (hWnd=0x301e2, nCmdShow=0) returned 0 [0083.040] ShowWindow (hWnd=0x301e2, nCmdShow=0) returned 0 [0083.040] PeekMessageW (in: lpMsg=0x90f73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f73c) returned 0 [0083.041] CharUpperBuffW (in: lpsz="EYUGCPDIYNRZXLSBKUGV", cchLength=0x14 | out: lpsz="EYUGCPDIYNRZXLSBKUGV") returned 0x14 [0083.041] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.041] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.041] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.042] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.042] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.042] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.043] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.044] CharUpperBuffW (in: lpsz="UserName", cchLength=0x8 | out: lpsz="USERNAME") returned 0x8 [0083.045] GetUserNameW (in: lpBuffer=0x90ef28, pcbBuffer=0x90f244 | out: lpBuffer="JPenUM", pcbBuffer=0x90f244) returned 1 [0083.047] PeekMessageW (in: lpMsg=0x90f73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f73c) returned 0 [0083.047] CharUpperBuffW (in: lpsz="VAWBPFJARYLSY_LWN__Z", cchLength=0x14 | out: lpsz="VAWBPFJARYLSY_LWN__Z") returned 0x14 [0083.047] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.047] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.047] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.048] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.049] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.050] CharUpperBuffW (in: lpsz="TempDir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0083.050] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x90ef28 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\") returned 0x23 [0083.050] PeekMessageW (in: lpMsg=0x90f73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f73c) returned 0 [0083.050] CharUpperBuffW (in: lpsz="PFTJCVYTZWZHJNBFDSVH", cchLength=0x14 | out: lpsz="PFTJCVYTZWZHJNBFDSVH") returned 0x14 [0083.050] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.050] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.050] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.050] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.050] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.050] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.050] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.050] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.050] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.051] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.052] CharUpperBuffW (in: lpsz="SystemDir", cchLength=0x9 | out: lpsz="SYSTEMDIR") returned 0x9 [0083.052] GetSystemDirectoryW (in: lpBuffer=0x90ef28, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0083.052] PeekMessageW (in: lpMsg=0x90f73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f73c) returned 0 [0083.052] CharUpperBuffW (in: lpsz="PWGBLLCVBIWPGOVCYHST", cchLength=0x14 | out: lpsz="PWGBLLCVBIWPGOVCYHST") returned 0x14 [0083.053] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.053] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.053] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.054] CharUpperBuffW (in: lpsz="SW_HIDE", cchLength=0x7 | out: lpsz="SW_HIDE") returned 0x7 [0083.055] PeekMessageW (in: lpMsg=0x90f73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f73c) returned 0 [0083.055] CharUpperBuffW (in: lpsz="QBAVKKEPMGFRIDJIQFYL", cchLength=0x14 | out: lpsz="QBAVKKEPMGFRIDJIQFYL") returned 0x14 [0083.055] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.055] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.055] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.056] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.057] CharUpperBuffW (in: lpsz="ScriptFullPath", cchLength=0xe | out: lpsz="SCRIPTFULLPATH") returned 0xe [0083.057] PeekMessageW (in: lpMsg=0x90f73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f73c) returned 0 [0083.058] CharUpperBuffW (in: lpsz="ZHFSEIECLKQLCIGLUFVW", cchLength=0x14 | out: lpsz="ZHFSEIECLKQLCIGLUFVW") returned 0x14 [0083.058] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.058] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.058] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.059] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] CharUpperBuffW (in: lpsz="ScriptDir", cchLength=0x9 | out: lpsz="SCRIPTDIR") returned 0x9 [0083.062] PeekMessageW (in: lpMsg=0x90f73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f73c) returned 0 [0083.062] CharUpperBuffW (in: lpsz="ZASLDIOHJDVRTPWQRMGV", cchLength=0x14 | out: lpsz="ZASLDIOHJDVRTPWQRMGV") returned 0x14 [0083.062] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.062] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90ea2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea2c) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.064] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0083.064] CharUpperBuffW (in: lpsz="JSKPHBPSKKETVRDBHNYU", cchLength=0x14 | out: lpsz="JSKPHBPSKKETVRDBHNYU") returned 0x14 [0083.064] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.064] CharUpperBuffW (in: lpsz="HomeDrive", cchLength=0x9 | out: lpsz="HOMEDRIVE") returned 0x9 [0083.065] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x90ef28, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0083.065] CharUpperBuffW (in: lpsz="M_INUGTJHWXCPAXMCTAI", cchLength=0x14 | out: lpsz="M_INUGTJHWXCPAXMCTAI") returned 0x14 [0083.065] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.065] CharUpperBuffW (in: lpsz="ComSpec", cchLength=0x7 | out: lpsz="COMSPEC") returned 0x7 [0083.065] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x90ef28, nSize=0x104 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.065] CharUpperBuffW (in: lpsz="BNSYFESKKKXMBYSQHJIQ", cchLength=0x14 | out: lpsz="BNSYFESKKKXMBYSQHJIQ") returned 0x14 [0083.066] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.066] CharUpperBuffW (in: lpsz="AutoItPID", cchLength=0x9 | out: lpsz="AUTOITPID") returned 0x9 [0083.066] GetCurrentProcessId () returned 0x30c [0083.066] CharUpperBuffW (in: lpsz="LSGCAGMKVJRPUYNSDWVN", cchLength=0x14 | out: lpsz="LSGCAGMKVJRPUYNSDWVN") returned 0x14 [0083.066] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.066] CharUpperBuffW (in: lpsz="AutoItExe", cchLength=0x9 | out: lpsz="AUTOITEXE") returned 0x9 [0083.066] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8fef00, nSize=0x7fff | out: lpFilename="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe")) returned 0x5c [0083.066] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", nBufferLength=0x7fff, lpBuffer=0x8eeef0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x0) returned 0x5c [0083.066] CharUpperBuffW (in: lpsz="FDVIELPYQBHFBSHKWRNV", cchLength=0x14 | out: lpsz="FDVIELPYQBHFBSHKWRNV") returned 0x14 [0083.067] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0083.067] CharUpperBuffW (in: lpsz="AppDataDir", cchLength=0xa | out: lpsz="APPDATADIR") returned 0xa [0083.067] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x90ed08 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0083.068] CharUpperBuffW (in: lpsz="ISJEZZKAOCFKNHTKJDQV", cchLength=0x14 | out: lpsz="ISJEZZKAOCFKNHTKJDQV") returned 0x14 [0083.069] CharUpperBuffW (in: lpsz="WinExists", cchLength=0x9 | out: lpsz="WINEXISTS") returned 0x9 [0083.069] CharUpperBuffW (in: lpsz="MUSXQUMBQMSLTQRKARJJ", cchLength=0x14 | out: lpsz="MUSXQUMBQMSLTQRKARJJ") returned 0x14 [0083.069] CharUpperBuffW (in: lpsz="StringLen", cchLength=0x9 | out: lpsz="STRINGLEN") returned 0x9 [0083.069] CharUpperBuffW (in: lpsz="NOTRRKJGTFVXPFAOQZVF", cchLength=0x14 | out: lpsz="NOTRRKJGTFVXPFAOQZVF") returned 0x14 [0083.069] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.070] CharUpperBuffW (in: lpsz="StringInStr", cchLength=0xb | out: lpsz="STRINGINSTR") returned 0xb [0083.070] CharUpperBuffW (in: lpsz="JUPVPXOMUFXFQHXUCWSH", cchLength=0x14 | out: lpsz="JUPVPXOMUFXFQHXUCWSH") returned 0x14 [0083.070] CharUpperBuffW (in: lpsz="Sleep", cchLength=0x5 | out: lpsz="SLEEP") returned 0x5 [0083.070] CharUpperBuffW (in: lpsz="PRASBOPNM_MGRQFGBQCF", cchLength=0x14 | out: lpsz="PRASBOPNM_MGRQFGBQCF") returned 0x14 [0083.070] CharUpperBuffW (in: lpsz="ShellExecute", cchLength=0xc | out: lpsz="SHELLEXECUTE") returned 0xc [0083.070] CharUpperBuffW (in: lpsz="QUUZWZOLIYMFBCZKMNKZ", cchLength=0x14 | out: lpsz="QUUZWZOLIYMFBCZKMNKZ") returned 0x14 [0083.070] CharUpperBuffW (in: lpsz="RegWrite", cchLength=0x8 | out: lpsz="REGWRITE") returned 0x8 [0083.070] CharUpperBuffW (in: lpsz="NVDECIIZNY_FJETTNKCF", cchLength=0x14 | out: lpsz="NVDECIIZNY_FJETTNKCF") returned 0x14 [0083.070] CharUpperBuffW (in: lpsz="RegRead", cchLength=0x7 | out: lpsz="REGREAD") returned 0x7 [0083.070] CharUpperBuffW (in: lpsz="JCBCSQJKBAHQJLQPHFQD", cchLength=0x14 | out: lpsz="JCBCSQJKBAHQJLQPHFQD") returned 0x14 [0083.071] CharUpperBuffW (in: lpsz="Random", cchLength=0x6 | out: lpsz="RANDOM") returned 0x6 [0083.071] CharUpperBuffW (in: lpsz="KAHBDEOIEXWXMYTRRTOX", cchLength=0x14 | out: lpsz="KAHBDEOIEXWXMYTRRTOX") returned 0x14 [0083.071] CharUpperBuffW (in: lpsz="Ptr", cchLength=0x3 | out: lpsz="PTR") returned 0x3 [0083.071] CharUpperBuffW (in: lpsz="ZHMUXYEMHNIVGJBJDMMF", cchLength=0x14 | out: lpsz="ZHMUXYEMHNIVGJBJDMMF") returned 0x14 [0083.071] CharUpperBuffW (in: lpsz="ObjGet", cchLength=0x6 | out: lpsz="OBJGET") returned 0x6 [0083.071] CharUpperBuffW (in: lpsz="VMLKPAFPAPNKNHTCBZRR", cchLength=0x14 | out: lpsz="VMLKPAFPAPNKNHTCBZRR") returned 0x14 [0083.071] CharUpperBuffW (in: lpsz="Mod", cchLength=0x3 | out: lpsz="MOD") returned 0x3 [0083.071] CharUpperBuffW (in: lpsz="REDKXUVIBQAOCPLAQHXB", cchLength=0x14 | out: lpsz="REDKXUVIBQAOCPLAQHXB") returned 0x14 [0083.071] CharUpperBuffW (in: lpsz="IsString", cchLength=0x8 | out: lpsz="ISSTRING") returned 0x8 [0083.072] CharUpperBuffW (in: lpsz="OJTKASVFTSYXKBWX_WNX", cchLength=0x14 | out: lpsz="OJTKASVFTSYXKBWX_WNX") returned 0x14 [0083.072] CharUpperBuffW (in: lpsz="IsPtr", cchLength=0x5 | out: lpsz="ISPTR") returned 0x5 [0083.072] CharUpperBuffW (in: lpsz="ZAWMLSAXDCXMHRNMO_WJ", cchLength=0x14 | out: lpsz="ZAWMLSAXDCXMHRNMO_WJ") returned 0x14 [0083.074] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.074] CharUpperBuffW (in: lpsz="IsFloat", cchLength=0x7 | out: lpsz="ISFLOAT") returned 0x7 [0083.074] CharUpperBuffW (in: lpsz="PHPGCBELK_YPOEERMNXJ", cchLength=0x14 | out: lpsz="PHPGCBELK_YPOEERMNXJ") returned 0x14 [0083.074] CharUpperBuffW (in: lpsz="IsBool", cchLength=0x6 | out: lpsz="ISBOOL") returned 0x6 [0083.074] CharUpperBuffW (in: lpsz="WOCMAOSQEUUABGNESWBM", cchLength=0x14 | out: lpsz="WOCMAOSQEUUABGNESWBM") returned 0x14 [0083.074] CharUpperBuffW (in: lpsz="IsBinary", cchLength=0x8 | out: lpsz="ISBINARY") returned 0x8 [0083.074] CharUpperBuffW (in: lpsz="KGPWKXXEFKMQLGNWECVG", cchLength=0x14 | out: lpsz="KGPWKXXEFKMQLGNWECVG") returned 0x14 [0083.074] CharUpperBuffW (in: lpsz="IsAdmin", cchLength=0x7 | out: lpsz="ISADMIN") returned 0x7 [0083.074] CharUpperBuffW (in: lpsz="MAHKEWEXGTPUVKVEGPO_", cchLength=0x14 | out: lpsz="MAHKEWEXGTPUVKVEGPO_") returned 0x14 [0083.074] CharUpperBuffW (in: lpsz="Int", cchLength=0x3 | out: lpsz="INT") returned 0x3 [0083.075] CharUpperBuffW (in: lpsz="_YWCISGXTVBDUOVXPQMI", cchLength=0x14 | out: lpsz="_YWCISGXTVBDUOVXPQMI") returned 0x14 [0083.075] CharUpperBuffW (in: lpsz="FileWrite", cchLength=0x9 | out: lpsz="FILEWRITE") returned 0x9 [0083.075] CharUpperBuffW (in: lpsz="DUZNPLRFXOELYOJWMYRZ", cchLength=0x14 | out: lpsz="DUZNPLRFXOELYOJWMYRZ") returned 0x14 [0083.075] CharUpperBuffW (in: lpsz="FileSetAttrib", cchLength=0xd | out: lpsz="FILESETATTRIB") returned 0xd [0083.075] CharUpperBuffW (in: lpsz="JXHOFWTYAAIMRXVFTQE_", cchLength=0x14 | out: lpsz="JXHOFWTYAAIMRXVFTQE_") returned 0x14 [0083.075] CharUpperBuffW (in: lpsz="FileRead", cchLength=0x8 | out: lpsz="FILEREAD") returned 0x8 [0083.075] CharUpperBuffW (in: lpsz="SACWIMSIHENVHPTUMXPE", cchLength=0x14 | out: lpsz="SACWIMSIHENVHPTUMXPE") returned 0x14 [0083.075] CharUpperBuffW (in: lpsz="FileOpen", cchLength=0x8 | out: lpsz="FILEOPEN") returned 0x8 [0083.075] CharUpperBuffW (in: lpsz="XUULJMNSYNUPYVWXSZYG", cchLength=0x14 | out: lpsz="XUULJMNSYNUPYVWXSZYG") returned 0x14 [0083.076] CharUpperBuffW (in: lpsz="FileExists", cchLength=0xa | out: lpsz="FILEEXISTS") returned 0xa [0083.076] CharUpperBuffW (in: lpsz="GSMCLNXRCRDHAXIOWENF", cchLength=0x14 | out: lpsz="GSMCLNXRCRDHAXIOWENF") returned 0x14 [0083.077] CharUpperBuffW (in: lpsz="FileDelete", cchLength=0xa | out: lpsz="FILEDELETE") returned 0xa [0083.077] CharUpperBuffW (in: lpsz="DLESKBDQQFCHDDDMIDEA", cchLength=0x14 | out: lpsz="DLESKBDQQFCHDDDMIDEA") returned 0x14 [0083.077] CharUpperBuffW (in: lpsz="FileCopy", cchLength=0x8 | out: lpsz="FILECOPY") returned 0x8 [0083.077] CharUpperBuffW (in: lpsz="XHOSXSKKYFMAUHTBFHCA", cchLength=0x14 | out: lpsz="XHOSXSKKYFMAUHTBFHCA") returned 0x14 [0083.077] CharUpperBuffW (in: lpsz="FileClose", cchLength=0x9 | out: lpsz="FILECLOSE") returned 0x9 [0083.077] CharUpperBuffW (in: lpsz="_QEYKFIAHEYCACPPUXWV", cchLength=0x14 | out: lpsz="_QEYKFIAHEYCACPPUXWV") returned 0x14 [0083.078] CharUpperBuffW (in: lpsz="Eval", cchLength=0x4 | out: lpsz="EVAL") returned 0x4 [0083.078] CharUpperBuffW (in: lpsz="M_FBUIIQDAGUAU_RACCL", cchLength=0x14 | out: lpsz="M_FBUIIQDAGUAU_RACCL") returned 0x14 [0083.078] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.078] CharUpperBuffW (in: lpsz="DriveGetDrive", cchLength=0xd | out: lpsz="DRIVEGETDRIVE") returned 0xd [0083.078] CharUpperBuffW (in: lpsz="NDCHJOSUDZTBTGVUCWDB", cchLength=0x14 | out: lpsz="NDCHJOSUDZTBTGVUCWDB") returned 0x14 [0083.078] CharUpperBuffW (in: lpsz="DllStructSetData", cchLength=0x10 | out: lpsz="DLLSTRUCTSETDATA") returned 0x10 [0083.078] CharUpperBuffW (in: lpsz="ERXPGKRYZYLSLKZDSACZ", cchLength=0x14 | out: lpsz="ERXPGKRYZYLSLKZDSACZ") returned 0x14 [0083.078] CharUpperBuffW (in: lpsz="DllStructGetSize", cchLength=0x10 | out: lpsz="DLLSTRUCTGETSIZE") returned 0x10 [0083.078] CharUpperBuffW (in: lpsz="FZMDXRSNTFQG_ZPUEHLH", cchLength=0x14 | out: lpsz="FZMDXRSNTFQG_ZPUEHLH") returned 0x14 [0083.079] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.079] CharUpperBuffW (in: lpsz="DllStructGetPtr", cchLength=0xf | out: lpsz="DLLSTRUCTGETPTR") returned 0xf [0083.079] CharUpperBuffW (in: lpsz="BRMZWPJQKKWFLEAGBXUX", cchLength=0x14 | out: lpsz="BRMZWPJQKKWFLEAGBXUX") returned 0x14 [0083.079] CharUpperBuffW (in: lpsz="DllStructGetData", cchLength=0x10 | out: lpsz="DLLSTRUCTGETDATA") returned 0x10 [0083.080] CharUpperBuffW (in: lpsz="ETDESII_JCPEKLNFZOOK", cchLength=0x14 | out: lpsz="ETDESII_JCPEKLNFZOOK") returned 0x14 [0083.080] CharUpperBuffW (in: lpsz="DllStructCreate", cchLength=0xf | out: lpsz="DLLSTRUCTCREATE") returned 0xf [0083.080] CharUpperBuffW (in: lpsz="WJNZPVCEXYQAWKKAOPXE", cchLength=0x14 | out: lpsz="WJNZPVCEXYQAWKKAOPXE") returned 0x14 [0083.080] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.080] CharUpperBuffW (in: lpsz="DllOpen", cchLength=0x7 | out: lpsz="DLLOPEN") returned 0x7 [0083.081] CharUpperBuffW (in: lpsz="RZBCABNWUPZLBALLSEYP", cchLength=0x14 | out: lpsz="RZBCABNWUPZLBALLSEYP") returned 0x14 [0083.081] CharUpperBuffW (in: lpsz="DllClose", cchLength=0x8 | out: lpsz="DLLCLOSE") returned 0x8 [0083.081] CharUpperBuffW (in: lpsz="ZU_OYEQNTWHCWPJPGJNX", cchLength=0x14 | out: lpsz="ZU_OYEQNTWHCWPJPGJNX") returned 0x14 [0083.081] CharUpperBuffW (in: lpsz="DllCallAddress", cchLength=0xe | out: lpsz="DLLCALLADDRESS") returned 0xe [0083.081] CharUpperBuffW (in: lpsz="GFJLYFLSIGQNQEMTCMBN", cchLength=0x14 | out: lpsz="GFJLYFLSIGQNQEMTCMBN") returned 0x14 [0083.082] CharUpperBuffW (in: lpsz="DllCall", cchLength=0x7 | out: lpsz="DLLCALL") returned 0x7 [0083.082] CharUpperBuffW (in: lpsz="ADRCTQTHUSOPR_NYNBYS", cchLength=0x14 | out: lpsz="ADRCTQTHUSOPR_NYNBYS") returned 0x14 [0083.082] PeekMessageW (in: lpMsg=0x90f0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f0d4) returned 0 [0083.082] CharUpperBuffW (in: lpsz="DirCreate", cchLength=0x9 | out: lpsz="DIRCREATE") returned 0x9 [0083.082] CharUpperBuffW (in: lpsz="XYVOCQGEPGTRBENKHFBB", cchLength=0x14 | out: lpsz="XYVOCQGEPGTRBENKHFBB") returned 0x14 [0083.083] CharUpperBuffW (in: lpsz="BinaryMid", cchLength=0x9 | out: lpsz="BINARYMID") returned 0x9 [0083.083] CharUpperBuffW (in: lpsz="NKYYMWXNOLVPNJOWSPHU", cchLength=0x14 | out: lpsz="NKYYMWXNOLVPNJOWSPHU") returned 0x14 [0083.083] CharUpperBuffW (in: lpsz="BinaryLen", cchLength=0x9 | out: lpsz="BINARYLEN") returned 0x9 [0083.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x90f1a0 | out: lpSystemTimeAsFileTime=0x90f1a0*(dwLowDateTime=0x20129d30, dwHighDateTime=0x1d4b1a5)) [0083.083] CharUpperBuffW (in: lpsz="NZPZJNK_OOFQCFTPSFQU", cchLength=0x14 | out: lpsz="NZPZJNK_OOFQCFTPSFQU") returned 0x14 [0083.084] PeekMessageW (in: lpMsg=0x90ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee84) returned 0 [0083.084] PeekMessageW (in: lpMsg=0x90ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee84) returned 0 [0083.085] CharUpperBuffW (in: lpsz="ANTIEMULATION", cchLength=0xd | out: lpsz="ANTIEMULATION") returned 0xd [0083.085] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.085] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.085] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.085] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.086] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.086] CharUpperBuffW (in: lpsz="VPMTSGRTYAWJBNTCAFQV", cchLength=0x14 | out: lpsz="VPMTSGRTYAWJBNTCAFQV") returned 0x14 [0083.086] CharUpperBuffW (in: lpsz="RTVNJRJDKSCKHKDVEEKZ", cchLength=0x14 | out: lpsz="RTVNJRJDKSCKHKDVEEKZ") returned 0x14 [0083.086] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.086] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.086] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.086] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.086] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.087] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.087] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.087] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.088] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.088] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.088] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.088] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.088] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.088] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.088] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.088] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.088] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.089] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.089] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.089] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.089] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.089] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.089] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.089] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.089] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.089] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.089] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.089] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.090] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.090] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.090] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.090] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.090] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.090] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.091] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.091] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.091] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.091] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.091] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.091] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.091] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.091] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.091] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.092] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.092] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.092] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.092] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.092] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.092] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.092] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.094] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.094] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.094] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.094] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.094] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.094] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.094] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.094] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.094] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.094] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.095] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.095] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.095] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.095] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.095] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.095] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.095] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.095] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.096] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.096] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.096] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.096] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.096] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.097] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.097] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.097] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.097] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.097] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.098] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.098] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.098] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.098] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.098] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.098] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.098] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.098] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.098] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.099] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.099] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.099] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.099] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.099] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.099] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.099] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.099] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.100] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.100] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.100] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.100] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.100] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.101] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.101] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.101] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.101] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.101] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.101] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.101] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.102] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.102] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.102] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.102] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.102] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.102] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.102] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.102] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.102] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.102] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.102] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.103] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.103] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.103] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.103] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.103] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.103] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.104] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.104] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.104] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.104] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.104] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.104] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.104] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.104] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.104] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.104] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.105] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.105] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.105] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.105] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.105] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.105] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.106] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.106] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.106] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.107] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.107] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.107] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.107] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.107] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.107] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.107] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.108] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.108] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.108] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.108] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.108] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.108] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.109] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.109] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.109] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.109] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.109] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.109] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.109] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.109] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.110] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.110] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.110] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.110] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.110] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.110] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.110] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.110] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.110] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.110] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.111] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.111] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.111] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.111] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.111] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.111] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.111] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.111] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.111] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.111] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.112] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.112] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.112] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.112] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.112] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.112] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.112] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.112] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.113] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.113] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.113] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.113] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.113] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.113] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.113] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.113] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.113] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.114] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.114] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.114] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.114] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.114] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.114] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.114] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.114] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.114] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.115] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.115] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.115] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.115] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.115] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.115] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.115] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.115] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.116] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.116] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.116] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.116] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.116] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.116] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.116] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.117] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.118] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.123] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.130] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.130] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.132] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.133] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.139] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.144] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.147] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.152] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.153] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.156] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.157] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.168] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.169] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.171] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.171] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.179] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.180] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.185] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.186] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.199] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.200] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.201] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.202] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.206] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.213] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.216] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.217] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.218] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.219] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.221] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.222] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.224] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.237] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.267] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.332] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0083.343] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.439] PeekMessageW (in: lpMsg=0x90ee7c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ee7c) returned 0 [0083.549] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8fed18, nSize=0x7fff | out: lpFilename="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe")) returned 0x5c [0083.549] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", nBufferLength=0x7fff, lpBuffer=0x8eed08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x0) returned 0x5c [0083.550] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe:Zone.Identifier", nBufferLength=0x7fff, lpBuffer=0x8fef48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe:Zone.Identifier", lpFilePart=0x0) returned 0x6c [0083.550] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe:Zone.Identifier" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe:zone.identifier")) returned 0xffffffff [0083.550] FindFirstFileW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe:Zone.Identifier", lpFindFileData=0x90ef90 | out: lpFindFileData=0x90ef90) returned 0xffffffff [0083.550] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0083.550] CharUpperBuffW (in: lpsz="SJFZLYEDBWKTCRUEK", cchLength=0x11 | out: lpsz="SJFZLYEDBWKTCRUEK") returned 0x11 [0083.551] CharUpperBuffW (in: lpsz="EOYHLBQUNPHWLCZHVIPGMR", cchLength=0x16 | out: lpsz="EOYHLBQUNPHWLCZHVIPGMR") returned 0x16 [0083.551] CharUpperBuffW (in: lpsz="DAVCLYVQGTNBHSUXQQGTWIDRKD", cchLength=0x1a | out: lpsz="DAVCLYVQGTNBHSUXQQGTWIDRKD") returned 0x1a [0083.551] CharUpperBuffW (in: lpsz="DECDATA", cchLength=0x7 | out: lpsz="DECDATA") returned 0x7 [0083.551] CharUpperBuffW (in: lpsz="UAGZWDHRVSWIIOZRGDCPBLBXX", cchLength=0x19 | out: lpsz="UAGZWDHRVSWIIOZRGDCPBLBXX") returned 0x19 [0083.551] CharUpperBuffW (in: lpsz="HQJBCVHQCFCNTHXYDMIHVKRUQEWC", cchLength=0x1c | out: lpsz="HQJBCVHQCFCNTHXYDMIHVKRUQEWC") returned 0x1c [0083.551] CharUpperBuffW (in: lpsz="IGYGYWWHUIQCQOQQYNKW", cchLength=0x14 | out: lpsz="IGYGYWWHUIQCQOQQYNKW") returned 0x14 [0083.551] CharUpperBuffW (in: lpsz="VCIKFNQMTNFUTAZVGLPLO", cchLength=0x15 | out: lpsz="VCIKFNQMTNFUTAZVGLPLO") returned 0x15 [0083.551] CharUpperBuffW (in: lpsz="ANTIEMULATION", cchLength=0xd | out: lpsz="ANTIEMULATION") returned 0xd [0083.551] CharUpperBuffW (in: lpsz="CUKXVXVZGVOUEYETKUUTEC", cchLength=0x16 | out: lpsz="CUKXVXVZGVOUEYETKUUTEC") returned 0x16 [0083.551] CharUpperBuffW (in: lpsz="SYGWYUJDMHO", cchLength=0xb | out: lpsz="SYGWYUJDMHO") returned 0xb [0083.551] CharUpperBuffW (in: lpsz="DDELCTKAWMVJXSIZKVKR", cchLength=0x14 | out: lpsz="DDELCTKAWMVJXSIZKVKR") returned 0x14 [0083.551] CharUpperBuffW (in: lpsz="LAJPUUBTAUPYKYTXN", cchLength=0x11 | out: lpsz="LAJPUUBTAUPYKYTXN") returned 0x11 [0083.552] CharUpperBuffW (in: lpsz="TPAGBHUBMCHOAAR", cchLength=0xf | out: lpsz="TPAGBHUBMCHOAAR") returned 0xf [0083.552] CharUpperBuffW (in: lpsz="MMPUJJOGMCCXLHZBUFDEPEWFOAU", cchLength=0x1b | out: lpsz="MMPUJJOGMCCXLHZBUFDEPEWFOAU") returned 0x1b [0083.552] CharUpperBuffW (in: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK", cchLength=0x19 | out: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK") returned 0x19 [0083.552] CharUpperBuffW (in: lpsz="EYUGCPDIYNRZXLSBKUGV", cchLength=0x14 | out: lpsz="EYUGCPDIYNRZXLSBKUGV") returned 0x14 [0083.552] CharUpperBuffW (in: lpsz="VAWBPFJARYLSY_LWN__Z", cchLength=0x14 | out: lpsz="VAWBPFJARYLSY_LWN__Z") returned 0x14 [0083.552] CharUpperBuffW (in: lpsz="PFTJCVYTZWZHJNBFDSVH", cchLength=0x14 | out: lpsz="PFTJCVYTZWZHJNBFDSVH") returned 0x14 [0083.552] CharUpperBuffW (in: lpsz="PWGBLLCVBIWPGOVCYHST", cchLength=0x14 | out: lpsz="PWGBLLCVBIWPGOVCYHST") returned 0x14 [0083.552] CharUpperBuffW (in: lpsz="QBAVKKEPMGFRIDJIQFYL", cchLength=0x14 | out: lpsz="QBAVKKEPMGFRIDJIQFYL") returned 0x14 [0083.552] CharUpperBuffW (in: lpsz="ZHFSEIECLKQLCIGLUFVW", cchLength=0x14 | out: lpsz="ZHFSEIECLKQLCIGLUFVW") returned 0x14 [0083.552] CharUpperBuffW (in: lpsz="ZASLDIOHJDVRTPWQRMGV", cchLength=0x14 | out: lpsz="ZASLDIOHJDVRTPWQRMGV") returned 0x14 [0083.552] CharUpperBuffW (in: lpsz="JSKPHBPSKKETVRDBHNYU", cchLength=0x14 | out: lpsz="JSKPHBPSKKETVRDBHNYU") returned 0x14 [0083.552] CharUpperBuffW (in: lpsz="M_INUGTJHWXCPAXMCTAI", cchLength=0x14 | out: lpsz="M_INUGTJHWXCPAXMCTAI") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="BNSYFESKKKXMBYSQHJIQ", cchLength=0x14 | out: lpsz="BNSYFESKKKXMBYSQHJIQ") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="LSGCAGMKVJRPUYNSDWVN", cchLength=0x14 | out: lpsz="LSGCAGMKVJRPUYNSDWVN") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="FDVIELPYQBHFBSHKWRNV", cchLength=0x14 | out: lpsz="FDVIELPYQBHFBSHKWRNV") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="ISJEZZKAOCFKNHTKJDQV", cchLength=0x14 | out: lpsz="ISJEZZKAOCFKNHTKJDQV") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="MUSXQUMBQMSLTQRKARJJ", cchLength=0x14 | out: lpsz="MUSXQUMBQMSLTQRKARJJ") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="NOTRRKJGTFVXPFAOQZVF", cchLength=0x14 | out: lpsz="NOTRRKJGTFVXPFAOQZVF") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="JUPVPXOMUFXFQHXUCWSH", cchLength=0x14 | out: lpsz="JUPVPXOMUFXFQHXUCWSH") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="PRASBOPNM_MGRQFGBQCF", cchLength=0x14 | out: lpsz="PRASBOPNM_MGRQFGBQCF") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="QUUZWZOLIYMFBCZKMNKZ", cchLength=0x14 | out: lpsz="QUUZWZOLIYMFBCZKMNKZ") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="NVDECIIZNY_FJETTNKCF", cchLength=0x14 | out: lpsz="NVDECIIZNY_FJETTNKCF") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="JCBCSQJKBAHQJLQPHFQD", cchLength=0x14 | out: lpsz="JCBCSQJKBAHQJLQPHFQD") returned 0x14 [0083.553] CharUpperBuffW (in: lpsz="KAHBDEOIEXWXMYTRRTOX", cchLength=0x14 | out: lpsz="KAHBDEOIEXWXMYTRRTOX") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="ZHMUXYEMHNIVGJBJDMMF", cchLength=0x14 | out: lpsz="ZHMUXYEMHNIVGJBJDMMF") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="VMLKPAFPAPNKNHTCBZRR", cchLength=0x14 | out: lpsz="VMLKPAFPAPNKNHTCBZRR") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="REDKXUVIBQAOCPLAQHXB", cchLength=0x14 | out: lpsz="REDKXUVIBQAOCPLAQHXB") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="OJTKASVFTSYXKBWX_WNX", cchLength=0x14 | out: lpsz="OJTKASVFTSYXKBWX_WNX") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="ZAWMLSAXDCXMHRNMO_WJ", cchLength=0x14 | out: lpsz="ZAWMLSAXDCXMHRNMO_WJ") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="PHPGCBELK_YPOEERMNXJ", cchLength=0x14 | out: lpsz="PHPGCBELK_YPOEERMNXJ") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="WOCMAOSQEUUABGNESWBM", cchLength=0x14 | out: lpsz="WOCMAOSQEUUABGNESWBM") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="KGPWKXXEFKMQLGNWECVG", cchLength=0x14 | out: lpsz="KGPWKXXEFKMQLGNWECVG") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="MAHKEWEXGTPUVKVEGPO_", cchLength=0x14 | out: lpsz="MAHKEWEXGTPUVKVEGPO_") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="_YWCISGXTVBDUOVXPQMI", cchLength=0x14 | out: lpsz="_YWCISGXTVBDUOVXPQMI") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="DUZNPLRFXOELYOJWMYRZ", cchLength=0x14 | out: lpsz="DUZNPLRFXOELYOJWMYRZ") returned 0x14 [0083.554] CharUpperBuffW (in: lpsz="JXHOFWTYAAIMRXVFTQE_", cchLength=0x14 | out: lpsz="JXHOFWTYAAIMRXVFTQE_") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="SACWIMSIHENVHPTUMXPE", cchLength=0x14 | out: lpsz="SACWIMSIHENVHPTUMXPE") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="XUULJMNSYNUPYVWXSZYG", cchLength=0x14 | out: lpsz="XUULJMNSYNUPYVWXSZYG") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="GSMCLNXRCRDHAXIOWENF", cchLength=0x14 | out: lpsz="GSMCLNXRCRDHAXIOWENF") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="DLESKBDQQFCHDDDMIDEA", cchLength=0x14 | out: lpsz="DLESKBDQQFCHDDDMIDEA") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="XHOSXSKKYFMAUHTBFHCA", cchLength=0x14 | out: lpsz="XHOSXSKKYFMAUHTBFHCA") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="_QEYKFIAHEYCACPPUXWV", cchLength=0x14 | out: lpsz="_QEYKFIAHEYCACPPUXWV") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="M_FBUIIQDAGUAU_RACCL", cchLength=0x14 | out: lpsz="M_FBUIIQDAGUAU_RACCL") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="NDCHJOSUDZTBTGVUCWDB", cchLength=0x14 | out: lpsz="NDCHJOSUDZTBTGVUCWDB") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="ERXPGKRYZYLSLKZDSACZ", cchLength=0x14 | out: lpsz="ERXPGKRYZYLSLKZDSACZ") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="FZMDXRSNTFQG_ZPUEHLH", cchLength=0x14 | out: lpsz="FZMDXRSNTFQG_ZPUEHLH") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="BRMZWPJQKKWFLEAGBXUX", cchLength=0x14 | out: lpsz="BRMZWPJQKKWFLEAGBXUX") returned 0x14 [0083.555] CharUpperBuffW (in: lpsz="ETDESII_JCPEKLNFZOOK", cchLength=0x14 | out: lpsz="ETDESII_JCPEKLNFZOOK") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="WJNZPVCEXYQAWKKAOPXE", cchLength=0x14 | out: lpsz="WJNZPVCEXYQAWKKAOPXE") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="RZBCABNWUPZLBALLSEYP", cchLength=0x14 | out: lpsz="RZBCABNWUPZLBALLSEYP") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="ZU_OYEQNTWHCWPJPGJNX", cchLength=0x14 | out: lpsz="ZU_OYEQNTWHCWPJPGJNX") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="GFJLYFLSIGQNQEMTCMBN", cchLength=0x14 | out: lpsz="GFJLYFLSIGQNQEMTCMBN") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="ADRCTQTHUSOPR_NYNBYS", cchLength=0x14 | out: lpsz="ADRCTQTHUSOPR_NYNBYS") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="XYVOCQGEPGTRBENKHFBB", cchLength=0x14 | out: lpsz="XYVOCQGEPGTRBENKHFBB") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="NKYYMWXNOLVPNJOWSPHU", cchLength=0x14 | out: lpsz="NKYYMWXNOLVPNJOWSPHU") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="NZPZJNK_OOFQCFTPSFQU", cchLength=0x14 | out: lpsz="NZPZJNK_OOFQCFTPSFQU") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="_WDEFSLTADBXLOGIGOKQ", cchLength=0x14 | out: lpsz="_WDEFSLTADBXLOGIGOKQ") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="VDHLJOMTHWSZYHONMRPF", cchLength=0x14 | out: lpsz="VDHLJOMTHWSZYHONMRPF") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="CQLUJ_MIJQXUMXGTZSLA", cchLength=0x14 | out: lpsz="CQLUJ_MIJQXUMXGTZSLA") returned 0x14 [0083.556] CharUpperBuffW (in: lpsz="ERJFYBLH_EEKVPIUETBO", cchLength=0x14 | out: lpsz="ERJFYBLH_EEKVPIUETBO") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="NLYSVERQJQDWHOOLQLYL", cchLength=0x14 | out: lpsz="NLYSVERQJQDWHOOLQLYL") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="NBOKCHBJGETDUGZSYLQY", cchLength=0x14 | out: lpsz="NBOKCHBJGETDUGZSYLQY") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="JXHAAZUGXKRTOPRLOCDH", cchLength=0x14 | out: lpsz="JXHAAZUGXKRTOPRLOCDH") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="KRIUJDYJ_INOVOBOWTOE", cchLength=0x14 | out: lpsz="KRIUJDYJ_INOVOBOWTOE") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="JILVZZMFCQJIPRSAQDGA", cchLength=0x14 | out: lpsz="JILVZZMFCQJIPRSAQDGA") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="SEMOFSJXFIHCUVZS_MIF", cchLength=0x14 | out: lpsz="SEMOFSJXFIHCUVZS_MIF") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="KS_WLIBBMU_BWHTBD_FA", cchLength=0x14 | out: lpsz="KS_WLIBBMU_BWHTBD_FA") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="LBKYTTUGWOPLNRBUXJVF", cchLength=0x14 | out: lpsz="LBKYTTUGWOPLNRBUXJVF") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="GYAAGFSRUS_WEXXHMQDR", cchLength=0x14 | out: lpsz="GYAAGFSRUS_WEXXHMQDR") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="FUKCVTWBKZATQJEONCFE", cchLength=0x14 | out: lpsz="FUKCVTWBKZATQJEONCFE") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="PFDZDKAWIWUBSRKHSTXB", cchLength=0x14 | out: lpsz="PFDZDKAWIWUBSRKHSTXB") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="SDHFVWXBSMFLZZLCLCSA", cchLength=0x14 | out: lpsz="SDHFVWXBSMFLZZLCLCSA") returned 0x14 [0083.557] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="WTDXRHKKKXUKQCKMTZIJ", cchLength=0x14 | out: lpsz="WTDXRHKKKXUKQCKMTZIJ") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="QVDTDQKIHNLXDKKOMDSS", cchLength=0x14 | out: lpsz="QVDTDQKIHNLXDKKOMDSS") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="BDRETLGTCOAMGSETKRIV", cchLength=0x14 | out: lpsz="BDRETLGTCOAMGSETKRIV") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="OKGOETBUJSOWLZUQGPUN", cchLength=0x14 | out: lpsz="OKGOETBUJSOWLZUQGPUN") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="SJAGSYGNOFBHGQYVBIAZ", cchLength=0x14 | out: lpsz="SJAGSYGNOFBHGQYVBIAZ") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="PKQYPLUXIWNVIUIEYBXY", cchLength=0x14 | out: lpsz="PKQYPLUXIWNVIUIEYBXY") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="JWHXOPFWQMM_RWIDFEIZ", cchLength=0x14 | out: lpsz="JWHXOPFWQMM_RWIDFEIZ") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="CLTNRMILWABNEYVBTHMG", cchLength=0x14 | out: lpsz="CLTNRMILWABNEYVBTHMG") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="RKOBNPFBPHXZWQZEEFKL", cchLength=0x14 | out: lpsz="RKOBNPFBPHXZWQZEEFKL") returned 0x14 [0083.558] CharUpperBuffW (in: lpsz="SSNIKPUAWTSFVFAAUJUJ", cchLength=0x14 | out: lpsz="SSNIKPUAWTSFVFAAUJUJ") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="SBWDVAJARWXSENESDBPB", cchLength=0x14 | out: lpsz="SBWDVAJARWXSENESDBPB") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="YHNGDJBMMGM_MOVOJOFD", cchLength=0x14 | out: lpsz="YHNGDJBMMGM_MOVOJOFD") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="AWRLSHYJRTOGTGYECYTE", cchLength=0x14 | out: lpsz="AWRLSHYJRTOGTGYECYTE") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="BTBIGLIXGBUHCJQRWWGP", cchLength=0x14 | out: lpsz="BTBIGLIXGBUHCJQRWWGP") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="GRPZSIBHHZBJMXFNJCJQ", cchLength=0x14 | out: lpsz="GRPZSIBHHZBJMXFNJCJQ") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="AMQDEPVGRFKYLKIXWFUE", cchLength=0x14 | out: lpsz="AMQDEPVGRFKYLKIXWFUE") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="DRWKLTSFSUYKEYGFYHQD", cchLength=0x14 | out: lpsz="DRWKLTSFSUYKEYGFYHQD") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="ABKWPVNUENAVQACYEFTI", cchLength=0x14 | out: lpsz="ABKWPVNUENAVQACYEFTI") returned 0x14 [0083.559] CharUpperBuffW (in: lpsz="SYOGJLMMAYDLTM_CJKEP", cchLength=0x14 | out: lpsz="SYOGJLMMAYDLTM_CJKEP") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="OMEBTERIXFCYORJVKGTE", cchLength=0x14 | out: lpsz="OMEBTERIXFCYORJVKGTE") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="KNNAIYDHZSRCVRFNBHZF", cchLength=0x14 | out: lpsz="KNNAIYDHZSRCVRFNBHZF") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="NRFRBMZPG_SQYOMMIAEX", cchLength=0x14 | out: lpsz="NRFRBMZPG_SQYOMMIAEX") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="TSQDPVNBMYTZDXESMLES", cchLength=0x14 | out: lpsz="TSQDPVNBMYTZDXESMLES") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="FEWPTOBLLJCUJEHHYGLG", cchLength=0x14 | out: lpsz="FEWPTOBLLJCUJEHHYGLG") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="US_RIYBUCILKFUWUWEDU", cchLength=0x14 | out: lpsz="US_RIYBUCILKFUWUWEDU") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="XFSWTCXAHIIWJXZLMYPY", cchLength=0x14 | out: lpsz="XFSWTCXAHIIWJXZLMYPY") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="WONTCZUQCNZAUJHELSBO", cchLength=0x14 | out: lpsz="WONTCZUQCNZAUJHELSBO") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="JFTVYKADTXOLYOSYZOAY", cchLength=0x14 | out: lpsz="JFTVYKADTXOLYOSYZOAY") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="NPEGDBGBJXFHDYAVULHL", cchLength=0x14 | out: lpsz="NPEGDBGBJXFHDYAVULHL") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0083.560] CharUpperBuffW (in: lpsz="RTVNJRJDKSCKHKDVEEKZ", cchLength=0x14 | out: lpsz="RTVNJRJDKSCKHKDVEEKZ") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="NGR_RGYWLIRLFAYSHHJK", cchLength=0x14 | out: lpsz="NGR_RGYWLIRLFAYSHHJK") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="IDXQIICQQWKNZSJCQWXO", cchLength=0x14 | out: lpsz="IDXQIICQQWKNZSJCQWXO") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="CGLYSV_VMJRNJJTCLUXS", cchLength=0x14 | out: lpsz="CGLYSV_VMJRNJJTCLUXS") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="PRWRLUFYJZWBMKYOBTGF", cchLength=0x14 | out: lpsz="PRWRLUFYJZWBMKYOBTGF") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="BBUTKNHPRBELTCKQDMXZ", cchLength=0x14 | out: lpsz="BBUTKNHPRBELTCKQDMXZ") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="JKCXJTLZTATLTKCPGXKH", cchLength=0x14 | out: lpsz="JKCXJTLZTATLTKCPGXKH") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="AJYEZDTNOSNQTTEIRRTN", cchLength=0x14 | out: lpsz="AJYEZDTNOSNQTTEIRRTN") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="SKIRTGLRHOFWUQUUQYOD", cchLength=0x14 | out: lpsz="SKIRTGLRHOFWUQUUQYOD") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="DOJZUHTZAPEIUCYQV_CH", cchLength=0x14 | out: lpsz="DOJZUHTZAPEIUCYQV_CH") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="SLAEVLLOVSIVJBMMHQKE", cchLength=0x14 | out: lpsz="SLAEVLLOVSIVJBMMHQKE") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="QVYQNDKGWIKKRWKKWVCQ", cchLength=0x14 | out: lpsz="QVYQNDKGWIKKRWKKWVCQ") returned 0x14 [0083.561] CharUpperBuffW (in: lpsz="TVASIEJUTJGCLNMPNKIN", cchLength=0x14 | out: lpsz="TVASIEJUTJGCLNMPNKIN") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="HMWMNGSESHZNGI_ZJEMP", cchLength=0x14 | out: lpsz="HMWMNGSESHZNGI_ZJEMP") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="TWHBKZQUTRXCNIMBHLCT", cchLength=0x14 | out: lpsz="TWHBKZQUTRXCNIMBHLCT") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="MRXYVNNENBQFMGDBQGGV", cchLength=0x14 | out: lpsz="MRXYVNNENBQFMGDBQGGV") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="HFOVTLOBFNGEQMVYPBQP", cchLength=0x14 | out: lpsz="HFOVTLOBFNGEQMVYPBQP") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="BNN_VUOZHLCAXYVQU_RM", cchLength=0x14 | out: lpsz="BNN_VUOZHLCAXYVQU_RM") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="GVMPCHVLDBPFGUDVAUTI", cchLength=0x14 | out: lpsz="GVMPCHVLDBPFGUDVAUTI") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="KVYQGTPSRIDKXHOSWNFL", cchLength=0x14 | out: lpsz="KVYQGTPSRIDKXHOSWNFL") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="XWIXBQLSBNHDNALKQPYB", cchLength=0x14 | out: lpsz="XWIXBQLSBNHDNALKQPYB") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="CAWVRYLMUYYELQKYLUDR", cchLength=0x14 | out: lpsz="CAWVRYLMUYYELQKYLUDR") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="VCPXMGLIKRBTBLYCJMWW", cchLength=0x14 | out: lpsz="VCPXMGLIKRBTBLYCJMWW") returned 0x14 [0083.562] CharUpperBuffW (in: lpsz="FKJPNAAULJEYFTJHPGRM", cchLength=0x14 | out: lpsz="FKJPNAAULJEYFTJHPGRM") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="MMBKMWVJWOGCINWBGHEI", cchLength=0x14 | out: lpsz="MMBKMWVJWOGCINWBGHEI") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="DVDMT_BXXKBFCCNTFGFO", cchLength=0x14 | out: lpsz="DVDMT_BXXKBFCCNTFGFO") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="TEQWXYVQXQTHQMKGBQMX", cchLength=0x14 | out: lpsz="TEQWXYVQXQTHQMKGBQMX") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="IGRXWNKNIDHAGDSCOBSK", cchLength=0x14 | out: lpsz="IGRXWNKNIDHAGDSCOBSK") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="_KGEVVOZKJJCBGPELJNU", cchLength=0x14 | out: lpsz="_KGEVVOZKJJCBGPELJNU") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="HFUNAXNYPKNZPOOJBABT", cchLength=0x14 | out: lpsz="HFUNAXNYPKNZPOOJBABT") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="TBIVCLBIASJGMYPGPNKM", cchLength=0x14 | out: lpsz="TBIVCLBIASJGMYPGPNKM") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="A_VGOSHEMIF_YFFLAXBE", cchLength=0x14 | out: lpsz="A_VGOSHEMIF_YFFLAXBE") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="HJMKOMUFBVOESN_YGRAC", cchLength=0x14 | out: lpsz="HJMKOMUFBVOESN_YGRAC") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="JISUMVPOAZL_JLZATLNM", cchLength=0x14 | out: lpsz="JISUMVPOAZL_JLZATLNM") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="FAMPZFRNGXLXBSAJXLZA", cchLength=0x14 | out: lpsz="FAMPZFRNGXLXBSAJXLZA") returned 0x14 [0083.563] CharUpperBuffW (in: lpsz="ECKMEMCHDOSIWWCIKFWC", cchLength=0x14 | out: lpsz="ECKMEMCHDOSIWWCIKFWC") returned 0x14 [0083.564] CharUpperBuffW (in: lpsz="_ZCGFXBMZNQJPDKODWUI", cchLength=0x14 | out: lpsz="_ZCGFXBMZNQJPDKODWUI") returned 0x14 [0083.564] CharUpperBuffW (in: lpsz="IFVTRKLQDVXTCMCDWCMI", cchLength=0x14 | out: lpsz="IFVTRKLQDVXTCMCDWCMI") returned 0x14 [0083.564] CharUpperBuffW (in: lpsz="FT__FJXV_ONADYQWZRHW", cchLength=0x14 | out: lpsz="FT__FJXV_ONADYQWZRHW") returned 0x14 [0083.564] CharUpperBuffW (in: lpsz="DTJCJZRYGGJJHVBBUMJG", cchLength=0x14 | out: lpsz="DTJCJZRYGGJJHVBBUMJG") returned 0x14 [0083.564] CharUpperBuffW (in: lpsz="QHGOOPWKGUOHQKVYDYES", cchLength=0x14 | out: lpsz="QHGOOPWKGUOHQKVYDYES") returned 0x14 [0083.564] CharUpperBuffW (in: lpsz="URONHQRVNUBWEATGZUFO", cchLength=0x14 | out: lpsz="URONHQRVNUBWEATGZUFO") returned 0x14 [0083.564] CharUpperBuffW (in: lpsz="DBYPH_KLVNBRGDXOHVKO", cchLength=0x14 | out: lpsz="DBYPH_KLVNBRGDXOHVKO") returned 0x14 [0083.564] CharUpperBuffW (in: lpsz="ZGGVWCXEDJQTJHMNMJGB", cchLength=0x14 | out: lpsz="ZGGVWCXEDJQTJHMNMJGB") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="WHTIBXLOOYEPETOZJYJH", cchLength=0x14 | out: lpsz="WHTIBXLOOYEPETOZJYJH") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="RNHUIJIZWMJYXGFIAAUL", cchLength=0x14 | out: lpsz="RNHUIJIZWMJYXGFIAAUL") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="EKVVREXDQUCG_SJXBEUS", cchLength=0x14 | out: lpsz="EKVVREXDQUCG_SJXBEUS") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="IHBMLZTZASLWWBHCNKKY", cchLength=0x14 | out: lpsz="IHBMLZTZASLWWBHCNKKY") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="NUDYADCXLRRSMFYNGQNQ", cchLength=0x14 | out: lpsz="NUDYADCXLRRSMFYNGQNQ") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="OVNRMJFAAVMIPXZPPROB", cchLength=0x14 | out: lpsz="OVNRMJFAAVMIPXZPPROB") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="BJLMTQLGRGTBWCILKCIQ", cchLength=0x14 | out: lpsz="BJLMTQLGRGTBWCILKCIQ") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="NVVLEDLWQZQCMBOKPSCF", cchLength=0x14 | out: lpsz="NVVLEDLWQZQCMBOKPSCF") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="FMZXLSJHHMLTZENDAMYM", cchLength=0x14 | out: lpsz="FMZXLSJHHMLTZENDAMYM") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="SPUTZWGLDAULZAFTWXZV", cchLength=0x14 | out: lpsz="SPUTZWGLDAULZAFTWXZV") returned 0x14 [0083.565] CharUpperBuffW (in: lpsz="GOQEEHSMEPRUOBDQKWUP", cchLength=0x14 | out: lpsz="GOQEEHSMEPRUOBDQKWUP") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="ATLRFHDEHDMGFCQ_MXHD", cchLength=0x14 | out: lpsz="ATLRFHDEHDMGFCQ_MXHD") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="FBNVQRDBUQMRSQUPZEVG", cchLength=0x14 | out: lpsz="FBNVQRDBUQMRSQUPZEVG") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="WKOWRNRO___TIJZXLUIE", cchLength=0x14 | out: lpsz="WKOWRNRO___TIJZXLUIE") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="KVOVOTDOKRIIMWHEBHMB", cchLength=0x14 | out: lpsz="KVOVOTDOKRIIMWHEBHMB") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="HLIQSXOUCNXEAZCUXEBS", cchLength=0x14 | out: lpsz="HLIQSXOUCNXEAZCUXEBS") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="TGW_L_HZLDXGZPZIRJYY", cchLength=0x14 | out: lpsz="TGW_L_HZLDXGZPZIRJYY") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="PHJZQBHGBLSQFJXCPK_M", cchLength=0x14 | out: lpsz="PHJZQBHGBLSQFJXCPK_M") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="VTPMSRTXCOOHOKDAOXEH", cchLength=0x14 | out: lpsz="VTPMSRTXCOOHOKDAOXEH") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="EBHLYPIUKAVZA_OGNFLT", cchLength=0x14 | out: lpsz="EBHLYPIUKAVZA_OGNFLT") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="PTIWEOWEASVD_VCSIPFW", cchLength=0x14 | out: lpsz="PTIWEOWEASVD_VCSIPFW") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="_MIJJBAKZIYTPWIRUNSM", cchLength=0x14 | out: lpsz="_MIJJBAKZIYTPWIRUNSM") returned 0x14 [0083.566] CharUpperBuffW (in: lpsz="ISXEVJELOZPMFPUUWN_M", cchLength=0x14 | out: lpsz="ISXEVJELOZPMFPUUWN_M") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="NUUVN_ACCRGZTONJQDDN", cchLength=0x14 | out: lpsz="NUUVN_ACCRGZTONJQDDN") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="MPUHLDKUBDWWLTDIERUE", cchLength=0x14 | out: lpsz="MPUHLDKUBDWWLTDIERUE") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="KPEAKNKTUNERIHXLHQPR", cchLength=0x14 | out: lpsz="KPEAKNKTUNERIHXLHQPR") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="YHPSZRIJQJDLOVRNSRMY", cchLength=0x14 | out: lpsz="YHPSZRIJQJDLOVRNSRMY") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="YYKFZMEHTHMRTTIZAYIK", cchLength=0x14 | out: lpsz="YYKFZMEHTHMRTTIZAYIK") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="XLLSVSFYSDLDRRVKAWOL", cchLength=0x14 | out: lpsz="XLLSVSFYSDLDRRVKAWOL") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="OCZOSOO_VZBANTXFMYTA", cchLength=0x14 | out: lpsz="OCZOSOO_VZBANTXFMYTA") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="RNVFZJYOJHYGNWHJITMW", cchLength=0x14 | out: lpsz="RNVFZJYOJHYGNWHJITMW") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="AOBCXARUGBAVBBAVHCGC", cchLength=0x14 | out: lpsz="AOBCXARUGBAVBBAVHCGC") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="Q_LFLBOXJUIHZMESROBD", cchLength=0x14 | out: lpsz="Q_LFLBOXJUIHZMESROBD") returned 0x14 [0083.567] CharUpperBuffW (in: lpsz="DIRCGVCYOUQJGIAZYVGM", cchLength=0x14 | out: lpsz="DIRCGVCYOUQJGIAZYVGM") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="JOJZCHXEYSELNQUOZTIM", cchLength=0x14 | out: lpsz="JOJZCHXEYSELNQUOZTIM") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="ZXL_EVRZLHUQLQPMJKXE", cchLength=0x14 | out: lpsz="ZXL_EVRZLHUQLQPMJKXE") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="DLAAVYZCQGXMSOLNZMZB", cchLength=0x14 | out: lpsz="DLAAVYZCQGXMSOLNZMZB") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="ZYPUBSLFSVZSLWIQEIDR", cchLength=0x14 | out: lpsz="ZYPUBSLFSVZSLWIQEIDR") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="BSBAWZNDNTYYFU_IBHZS", cchLength=0x14 | out: lpsz="BSBAWZNDNTYYFU_IBHZS") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="LQVDQPQEOBAKVEZUEERG", cchLength=0x14 | out: lpsz="LQVDQPQEOBAKVEZUEERG") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="ZNQMQJYARTCFEMTWJIHR", cchLength=0x14 | out: lpsz="ZNQMQJYARTCFEMTWJIHR") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="FLDM_QGWQIEKXWDTBRDB", cchLength=0x14 | out: lpsz="FLDM_QGWQIEKXWDTBRDB") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="QEFZWQPGSAHIFLGQVXV_", cchLength=0x14 | out: lpsz="QEFZWQPGSAHIFLGQVXV_") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="HSLWTF_FMHKWUUJGRQPF", cchLength=0x14 | out: lpsz="HSLWTF_FMHKWUUJGRQPF") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="ADJGKGMBRAQZFE_WYFMC", cchLength=0x14 | out: lpsz="ADJGKGMBRAQZFE_WYFMC") returned 0x14 [0083.568] CharUpperBuffW (in: lpsz="RHKCGUIZTHACOFKJWGPY", cchLength=0x14 | out: lpsz="RHKCGUIZTHACOFKJWGPY") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="XALBCOZOUUDGAIXIQMWV", cchLength=0x14 | out: lpsz="XALBCOZOUUDGAIXIQMWV") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="TE__JWNSXGEHGPPFMNCK", cchLength=0x14 | out: lpsz="TE__JWNSXGEHGPPFMNCK") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="NTJQCSZDHNUWDALIU_JH", cchLength=0x14 | out: lpsz="NTJQCSZDHNUWDALIU_JH") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="EOFPISWVZELPYTRELMNQ", cchLength=0x14 | out: lpsz="EOFPISWVZELPYTRELMNQ") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="DFUSZUZNKUVVAQ_OOESL", cchLength=0x14 | out: lpsz="DFUSZUZNKUVVAQ_OOESL") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="HQGJHNQBJP_BLS_VUEPT", cchLength=0x14 | out: lpsz="HQGJHNQBJP_BLS_VUEPT") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="IXJEARQUQLJKDRZVETNC", cchLength=0x14 | out: lpsz="IXJEARQUQLJKDRZVETNC") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="R_HXSMTQHZMLOY_OVNVQ", cchLength=0x14 | out: lpsz="R_HXSMTQHZMLOY_OVNVQ") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="IOWEKEVXKVBSQYBFFHAC", cchLength=0x14 | out: lpsz="IOWEKEVXKVBSQYBFFHAC") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="ZWVOLVHCXTTABYIH_QIK", cchLength=0x14 | out: lpsz="ZWVOLVHCXTTABYIH_QIK") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="YGZNUTVLBTUIUMORDGXG", cchLength=0x14 | out: lpsz="YGZNUTVLBTUIUMORDGXG") returned 0x14 [0083.569] CharUpperBuffW (in: lpsz="YCOQJF_WCPMLCUJOZPEM", cchLength=0x14 | out: lpsz="YCOQJF_WCPMLCUJOZPEM") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="PBCXQ_NYSQLKXTQ_MXRH", cchLength=0x14 | out: lpsz="PBCXQ_NYSQLKXTQ_MXRH") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="GTQVUATOAAGUKZQXRXAS", cchLength=0x14 | out: lpsz="GTQVUATOAAGUKZQXRXAS") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="YBURDCYGDWATQEEEPMID", cchLength=0x14 | out: lpsz="YBURDCYGDWATQEEEPMID") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="LVHRFAHBOPRTUFPMRKFA", cchLength=0x14 | out: lpsz="LVHRFAHBOPRTUFPMRKFA") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="VPMTSGRTYAWJBNTCAFQV", cchLength=0x14 | out: lpsz="VPMTSGRTYAWJBNTCAFQV") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="SPPTUPHEFIFRPFIUJWPE", cchLength=0x14 | out: lpsz="SPPTUPHEFIFRPFIUJWPE") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="YHDHNWJXFYSBOTMCLCCK", cchLength=0x14 | out: lpsz="YHDHNWJXFYSBOTMCLCCK") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="HBCXYPGZJYUIEUOFONZL", cchLength=0x14 | out: lpsz="HBCXYPGZJYUIEUOFONZL") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="KMFBYHCLQKWBVOTTPPUI", cchLength=0x14 | out: lpsz="KMFBYHCLQKWBVOTTPPUI") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="NPMWIEBZ_ZJZDZJGPRCB", cchLength=0x14 | out: lpsz="NPMWIEBZ_ZJZDZJGPRCB") returned 0x14 [0083.570] CharUpperBuffW (in: lpsz="FHAKUYOMQHQPYRQEESDU", cchLength=0x14 | out: lpsz="FHAKUYOMQHQPYRQEESDU") returned 0x14 [0083.571] CharUpperBuffW (in: lpsz="FGFFXQKHKEKMQEASRIFD", cchLength=0x14 | out: lpsz="FGFFXQKHKEKMQEASRIFD") returned 0x14 [0083.571] CharUpperBuffW (in: lpsz="LJWSHLJQLYCSCLLVIZWX", cchLength=0x14 | out: lpsz="LJWSHLJQLYCSCLLVIZWX") returned 0x14 [0083.571] CharUpperBuffW (in: lpsz="LMGXO__VIDUBLBNQ_URO", cchLength=0x14 | out: lpsz="LMGXO__VIDUBLBNQ_URO") returned 0x14 [0083.571] CharUpperBuffW (in: lpsz="KUJEVWMGAPXSFGHGYTMN", cchLength=0x14 | out: lpsz="KUJEVWMGAPXSFGHGYTMN") returned 0x14 [0083.571] CharUpperBuffW (in: lpsz="ZFRTZZSAHZYYERUFUTKH", cchLength=0x14 | out: lpsz="ZFRTZZSAHZYYERUFUTKH") returned 0x14 [0083.571] CharUpperBuffW (in: lpsz="VFTWGGPLXGJNWOXXDP_N", cchLength=0x14 | out: lpsz="VFTWGGPLXGJNWOXXDP_N") returned 0x14 [0083.571] CharUpperBuffW (in: lpsz="QHLVF_UXMS_ZKTPJHBHM", cchLength=0x14 | out: lpsz="QHLVF_UXMS_ZKTPJHBHM") returned 0x14 [0083.571] CharUpperBuffW (in: lpsz="HWIRORBETUPRHDGLYFQB", cchLength=0x14 | out: lpsz="HWIRORBETUPRHDGLYFQB") returned 0x14 [0083.572] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0083.573] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0083.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateMutexW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateMutexW", cchWideChar=13, lpMultiByteStr=0xd376a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateMutexW", lpUsedDefaultChar=0x0) returned 13 [0083.573] GetProcAddress (hModule=0x777b0000, lpProcName="CreateMutexW") returned 0x777f2aee [0083.574] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="AuditNativeSnapIn") returned 0x120 [0083.574] FreeLibrary (hLibModule=0x777b0000) returned 1 [0083.574] CharUpperBuffW (in: lpsz="YHPSZRIJQJDLOVRNSRMY", cchLength=0x14 | out: lpsz="YHPSZRIJQJDLOVRNSRMY") returned 0x14 [0083.574] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.574] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.574] CharUpperBuffW (in: lpsz="OCZOSOO_VZBANTXFMYTA", cchLength=0x14 | out: lpsz="OCZOSOO_VZBANTXFMYTA") returned 0x14 [0083.575] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0083.575] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0083.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetLastError", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetLastError", cchWideChar=13, lpMultiByteStr=0xd37010, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetLastError", lpUsedDefaultChar=0x0) returned 13 [0083.575] GetProcAddress (hModule=0x777b0000, lpProcName="GetLastError") returned 0x777fbf00 [0083.575] FreeLibrary (hLibModule=0x777b0000) returned 1 [0083.575] CharUpperBuffW (in: lpsz="LAJPUUBTAUPYKYTXN", cchLength=0x11 | out: lpsz="LAJPUUBTAUPYKYTXN") returned 0x11 [0083.575] CharUpperBuffW (in: lpsz="TMSKQOPVNSFXQQUYIFSK", cchLength=0x14 | out: lpsz="TMSKQOPVNSFXQQUYIFSK") returned 0x14 [0083.576] CharUpperBuffW (in: lpsz="YUXQUJTAPNSAJSQQGRCF", cchLength=0x14 | out: lpsz="YUXQUJTAPNSAJSQQGRCF") returned 0x14 [0083.576] CharUpperBuffW (in: lpsz="ZYQMYIHPZIAQJHXMDIAJ", cchLength=0x14 | out: lpsz="ZYQMYIHPZIAQJHXMDIAJ") returned 0x14 [0083.576] CharUpperBuffW (in: lpsz="ANGILWRLDVDE_PXWBSEL", cchLength=0x14 | out: lpsz="ANGILWRLDVDE_PXWBSEL") returned 0x14 [0083.576] CharUpperBuffW (in: lpsz="CRQEQZZLGAEPYQKCYUVH", cchLength=0x14 | out: lpsz="CRQEQZZLGAEPYQKCYUVH") returned 0x14 [0083.577] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0083.577] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.577] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.577] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.577] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.577] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.577] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.577] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.578] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.578] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.578] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.578] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.578] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.578] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.578] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.578] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Start") returned 5 [0083.578] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0083.578] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.578] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0083.578] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0083.578] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0083.578] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0083.578] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0083.578] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.578] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.578] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.578] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.578] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.578] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.578] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.578] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.578] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.578] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.579] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.579] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0083.579] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0083.579] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0083.579] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.579] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0083.579] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.579] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0083.579] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0083.579] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0083.579] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0083.579] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e2c0) returned 0x9 [0083.579] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0083.579] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.579] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.579] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="C") returned 1 [0083.579] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0083.579] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.579] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0083.579] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0083.579] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0083.579] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0083.579] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0083.579] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0083.579] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0083.579] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.580] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0083.580] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.580] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0083.580] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.580] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0083.580] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Oil") returned 3 [0083.580] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0083.580] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0083.580] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0083.580] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Runner") returned 6 [0083.580] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0083.580] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0083.580] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0083.580] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0083.580] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0083.580] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0083.580] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0083.580] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0083.580] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0083.580] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Charging") returned 8 [0083.580] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0083.580] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0083.580] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0083.580] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0083.580] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0083.580] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0083.580] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0083.580] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0083.581] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0083.581] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0083.581] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0083.581] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0083.581] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0083.581] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0083.581] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0083.581] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0083.581] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0083.581] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0083.581] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0083.581] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0083.581] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0083.581] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0083.581] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0083.581] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0083.581] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0083.581] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0083.581] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0083.581] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0083.581] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0083.581] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.581] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0083.581] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0083.581] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0083.581] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0083.581] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0083.581] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0083.581] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0083.581] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0083.582] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0083.582] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0083.582] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0083.582] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0083.582] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0083.582] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0083.582] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0083.582] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.582] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.582] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.582] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.582] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0083.582] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0083.582] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.582] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.582] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.582] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.582] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0083.582] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0083.582] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0083.582] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0083.583] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.583] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.583] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.583] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.583] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.583] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.583] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.583] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.583] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.583] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.583] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.583] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0083.583] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0083.583] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0083.583] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.583] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0083.583] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.583] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0083.583] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0083.583] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0083.583] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0083.583] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0083.583] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.583] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0083.583] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0083.583] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0083.583] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0083.583] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0083.583] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.583] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.583] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.584] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.584] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.584] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.584] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.585] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.585] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.585] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.585] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.585] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.585] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.585] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.585] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.585] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.585] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.585] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.586] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.586] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.586] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.586] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.587] CharUpperBuffW (in: lpsz="HAMOKBAMRNQLQWNMQBAB", cchLength=0x14 | out: lpsz="HAMOKBAMRNQLQWNMQBAB") returned 0x14 [0083.587] PeekMessageW (in: lpMsg=0x90e86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e86c) returned 0 [0083.587] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0083.587] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.587] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.587] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.587] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.587] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.587] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.587] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.587] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.588] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.588] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.588] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.588] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Start") returned 5 [0083.588] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0083.588] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0083.588] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0083.588] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0083.588] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0083.588] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0083.588] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.588] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.588] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.588] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.588] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.588] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0083.588] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0083.588] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0083.588] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0083.588] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.588] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0083.589] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0083.589] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0083.589] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0083.589] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e2c0) returned 0x9 [0083.589] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0083.589] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.589] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.589] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="C") returned 1 [0083.589] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0083.589] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.589] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0083.589] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0083.589] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0083.589] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0083.589] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0083.589] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0083.589] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0083.589] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.589] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0083.589] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.589] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0083.589] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.589] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0083.589] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Oil") returned 3 [0083.589] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0083.589] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0083.589] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0083.589] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Runner") returned 6 [0083.589] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0083.589] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0083.589] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0083.590] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0083.590] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0083.590] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0083.590] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0083.590] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0083.590] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0083.590] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Charging") returned 8 [0083.590] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0083.590] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0083.590] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0083.590] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0083.590] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0083.590] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0083.590] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0083.590] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0083.590] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0083.590] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0083.590] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0083.590] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0083.590] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0083.590] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0083.590] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0083.590] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0083.590] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0083.590] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0083.590] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0083.590] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0083.590] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0083.590] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0083.590] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0083.590] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0083.590] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0083.591] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0083.591] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0083.591] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0083.591] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0083.591] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.591] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0083.591] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0083.591] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0083.591] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0083.591] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0083.591] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0083.591] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0083.591] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0083.591] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0083.591] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.591] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0083.591] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0083.591] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0083.591] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.591] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0083.591] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0083.591] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0083.591] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.591] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.591] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.591] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.591] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.591] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.591] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.591] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.591] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0083.592] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0083.592] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.592] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.592] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.592] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0083.592] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0083.592] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0083.592] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0083.592] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.592] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.592] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.592] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.592] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.592] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0083.592] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0083.592] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0083.592] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0083.592] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.592] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0083.592] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0083.593] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0083.593] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0083.593] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0083.593] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="") returned 0 [0083.593] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0083.593] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0083.593] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0083.593] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0083.593] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0083.593] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.593] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.593] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.593] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.593] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.593] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.593] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.593] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.593] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.593] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.593] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.593] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.593] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.593] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.593] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.593] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.593] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.593] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.593] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.593] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.593] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.593] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.594] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.594] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.595] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.595] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.595] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.595] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.595] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.595] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.595] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.595] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.595] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.595] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.595] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.595] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.595] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.595] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.595] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.595] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.595] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e2c0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.595] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e2c0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.595] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.596] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.596] CharUpperBuffW (in: lpsz="JISHSAQNRFCRNIRYGBOZ", cchLength=0x14 | out: lpsz="JISHSAQNRFCRNIRYGBOZ") returned 0x14 [0083.596] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.596] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0083.596] CharUpperBuffW (in: lpsz="JHEUBZNWULMCVYSZIWHO", cchLength=0x14 | out: lpsz="JHEUBZNWULMCVYSZIWHO") returned 0x14 [0083.596] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0083.596] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0083.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0xd37220, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceW", lpUsedDefaultChar=0x0) returned 14 [0083.596] GetProcAddress (hModule=0x777b0000, lpProcName="FindResourceW") returned 0x777f3e61 [0083.597] FindResourceW (hModule=0x0, lpName="WFS1", lpType=0xa) returned 0x2f74d8 [0083.597] FreeLibrary (hLibModule=0x777b0000) returned 1 [0083.597] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.597] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.597] CharUpperBuffW (in: lpsz="LZXDYKDLWYEUUZHLDWMY", cchLength=0x14 | out: lpsz="LZXDYKDLWYEUUZHLDWMY") returned 0x14 [0083.597] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.597] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.597] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0083.597] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0083.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0xd374c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SizeofResource", lpUsedDefaultChar=0x0) returned 15 [0083.598] GetProcAddress (hModule=0x777b0000, lpProcName="SizeofResource") returned 0x777f3e7f [0083.598] SizeofResource (hModule=0x0, hResInfo=0x2f74d8) returned 0x50611 [0083.598] FreeLibrary (hLibModule=0x777b0000) returned 1 [0083.598] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.598] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.598] CharUpperBuffW (in: lpsz="DCSTEJJRTZWI_QDXAZHL", cchLength=0x14 | out: lpsz="DCSTEJJRTZWI_QDXAZHL") returned 0x14 [0083.598] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.598] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.598] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0083.598] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0083.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0xd370a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoadResource", lpUsedDefaultChar=0x0) returned 13 [0083.599] GetProcAddress (hModule=0x777b0000, lpProcName="LoadResource") returned 0x777f984d [0083.599] LoadResource (hModule=0x0, hResInfo=0x2f74d8) returned 0x4a51bc [0083.599] FreeLibrary (hLibModule=0x777b0000) returned 1 [0083.599] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.599] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.599] CharUpperBuffW (in: lpsz="KAMA_G_MVOPZHGX_NHVN", cchLength=0x14 | out: lpsz="KAMA_G_MVOPZHGX_NHVN") returned 0x14 [0083.599] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.599] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0083.600] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0083.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0xd37538, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LockResource", lpUsedDefaultChar=0x0) returned 13 [0083.600] GetProcAddress (hModule=0x777b0000, lpProcName="LockResource") returned 0x777efd29 [0083.600] LockResource (hResData=0x4a51bc) returned 0x4a51bc [0083.600] FreeLibrary (hLibModule=0x777b0000) returned 1 [0083.600] CharUpperBuffW (in: lpsz="IQOZHBYWTDLIHUPBFBUV", cchLength=0x14 | out: lpsz="IQOZHBYWTDLIHUPBFBUV") returned 0x14 [0083.600] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0083.600] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0083.600] CharLowerBuffW (in: lpsz="byte[329233]", cchLength=0xc | out: lpsz="byte[329233]") returned 0xc [0083.613] CharUpperBuffW (in: lpsz="LAJPUUBTAUPYKYTXN", cchLength=0x11 | out: lpsz="LAJPUUBTAUPYKYTXN") returned 0x11 [0083.613] CharUpperBuffW (in: lpsz="TMSKQOPVNSFXQQUYIFSK", cchLength=0x14 | out: lpsz="TMSKQOPVNSFXQQUYIFSK") returned 0x14 [0083.614] CharUpperBuffW (in: lpsz="YUXQUJTAPNSAJSQQGRCF", cchLength=0x14 | out: lpsz="YUXQUJTAPNSAJSQQGRCF") returned 0x14 [0083.614] CharUpperBuffW (in: lpsz="ZYQMYIHPZIAQJHXMDIAJ", cchLength=0x14 | out: lpsz="ZYQMYIHPZIAQJHXMDIAJ") returned 0x14 [0083.614] CharUpperBuffW (in: lpsz="ANGILWRLDVDE_PXWBSEL", cchLength=0x14 | out: lpsz="ANGILWRLDVDE_PXWBSEL") returned 0x14 [0083.614] CharUpperBuffW (in: lpsz="CRQEQZZLGAEPYQKCYUVH", cchLength=0x14 | out: lpsz="CRQEQZZLGAEPYQKCYUVH") returned 0x14 [0083.614] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0083.614] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.614] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Start") returned 5 [0083.615] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0083.615] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0083.615] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0083.615] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0083.615] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0083.615] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0083.615] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.615] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.615] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.616] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0083.616] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0083.616] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0083.616] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.616] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0083.616] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.616] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0083.616] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0083.616] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0083.616] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0083.616] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e2a8) returned 0x9 [0083.616] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0083.616] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.616] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.616] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="C") returned 1 [0083.616] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0083.616] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.616] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0083.616] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0083.616] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0083.616] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0083.616] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0083.616] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0083.616] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0083.616] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.616] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0083.616] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.616] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0083.616] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.616] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0083.616] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Oil") returned 3 [0083.616] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0083.617] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0083.617] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0083.617] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Runner") returned 6 [0083.617] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0083.617] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0083.617] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0083.617] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0083.617] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0083.617] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0083.617] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0083.617] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0083.617] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0083.617] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Charging") returned 8 [0083.617] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0083.617] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0083.617] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0083.617] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0083.617] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0083.617] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0083.617] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0083.617] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0083.617] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0083.617] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0083.617] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0083.617] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0083.617] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0083.617] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0083.617] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0083.617] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0083.617] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0083.617] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0083.617] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0083.618] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0083.618] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0083.618] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0083.618] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0083.618] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0083.618] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0083.618] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0083.618] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0083.618] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0083.618] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0083.618] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.618] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0083.618] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0083.618] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0083.618] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0083.618] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0083.618] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0083.618] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0083.618] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0083.618] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0083.618] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.618] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0083.618] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0083.618] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0083.618] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.618] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0083.618] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0083.618] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0083.618] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.618] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.618] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.618] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.619] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.619] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.619] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0083.619] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0083.619] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.619] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.619] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.619] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0083.619] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0083.619] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0083.619] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0083.619] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.619] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.619] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.619] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.619] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.619] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.619] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0083.619] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0083.620] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0083.620] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.620] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0083.620] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.620] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0083.620] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0083.620] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0083.620] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0083.620] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0083.620] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.620] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0083.620] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0083.620] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0083.620] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0083.620] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0083.620] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.620] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.620] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.620] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.620] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.620] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.620] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.620] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.620] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.620] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.620] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.620] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.620] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.620] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.620] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.620] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.620] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.621] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.621] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.622] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.622] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.622] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.622] CharUpperBuffW (in: lpsz="HAMOKBAMRNQLQWNMQBAB", cchLength=0x14 | out: lpsz="HAMOKBAMRNQLQWNMQBAB") returned 0x14 [0083.623] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0083.623] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.623] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.623] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.623] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.623] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.623] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.623] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.623] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Start") returned 5 [0083.623] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0083.623] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0083.623] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0083.623] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0083.623] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0083.623] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0083.623] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.623] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.623] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.623] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.623] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.624] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.624] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.624] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.624] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.624] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0083.624] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0083.624] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0083.624] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.624] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0083.624] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.624] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0083.624] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0083.624] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0083.624] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0083.624] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e2a8) returned 0x9 [0083.624] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0083.624] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.624] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.624] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="C") returned 1 [0083.624] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0083.624] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.624] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0083.624] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0083.624] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0083.624] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0083.624] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0083.624] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0083.624] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0083.624] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.624] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0083.624] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.624] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0083.625] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.625] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0083.625] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Oil") returned 3 [0083.625] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0083.625] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0083.625] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0083.625] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Runner") returned 6 [0083.625] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0083.625] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0083.625] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0083.625] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0083.625] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0083.625] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0083.625] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0083.625] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0083.625] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0083.625] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Charging") returned 8 [0083.625] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0083.625] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0083.625] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0083.625] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0083.625] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0083.625] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0083.625] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0083.625] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0083.625] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0083.625] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0083.625] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0083.625] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0083.625] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0083.625] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0083.625] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0083.626] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0083.626] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0083.626] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0083.626] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0083.626] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0083.626] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0083.626] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0083.626] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0083.626] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0083.626] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0083.626] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0083.626] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0083.626] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0083.626] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0083.626] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.626] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0083.626] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0083.626] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0083.626] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0083.626] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0083.626] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0083.626] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0083.626] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0083.626] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0083.626] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.626] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0083.626] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0083.626] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0083.626] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.626] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0083.627] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0083.627] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0083.627] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.627] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.627] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.627] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.627] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0083.627] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0083.627] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.627] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.627] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.627] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0083.627] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0083.627] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0083.627] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0083.627] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.627] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.627] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.627] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.627] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0083.628] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.628] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0083.628] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.628] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0083.628] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0083.628] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0083.628] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.628] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0083.628] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.628] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0083.628] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0083.628] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0083.628] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0083.628] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0083.628] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="") returned 0 [0083.628] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0083.628] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0083.628] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0083.628] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0083.628] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0083.628] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.628] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.628] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.628] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.628] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.628] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.628] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.628] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.628] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.628] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.628] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.628] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.629] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.629] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0083.630] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0083.630] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e2a8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0083.630] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e2a8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0083.630] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.631] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.631] CharUpperBuffW (in: lpsz="JISHSAQNRFCRNIRYGBOZ", cchLength=0x14 | out: lpsz="JISHSAQNRFCRNIRYGBOZ") returned 0x14 [0083.631] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.631] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0083.631] CharUpperBuffW (in: lpsz="JHEUBZNWULMCVYSZIWHO", cchLength=0x14 | out: lpsz="JHEUBZNWULMCVYSZIWHO") returned 0x14 [0083.631] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0083.631] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0083.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0xd37580, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceW", lpUsedDefaultChar=0x0) returned 14 [0083.632] GetProcAddress (hModule=0x777b0000, lpProcName="FindResourceW") returned 0x777f3e61 [0083.632] FindResourceW (hModule=0x0, lpName="DataUsageLiveTileTask2", lpType=0xa) returned 0x2f74a8 [0083.632] FreeLibrary (hLibModule=0x777b0000) returned 1 [0083.632] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.632] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.632] CharUpperBuffW (in: lpsz="LZXDYKDLWYEUUZHLDWMY", cchLength=0x14 | out: lpsz="LZXDYKDLWYEUUZHLDWMY") returned 0x14 [0083.632] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.632] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.632] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0083.632] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0083.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0xd36920, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SizeofResource", lpUsedDefaultChar=0x0) returned 15 [0083.633] GetProcAddress (hModule=0x777b0000, lpProcName="SizeofResource") returned 0x777f3e7f [0083.633] SizeofResource (hModule=0x0, hResInfo=0x2f74a8) returned 0x50611 [0083.633] FreeLibrary (hLibModule=0x777b0000) returned 1 [0083.633] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.633] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.633] CharUpperBuffW (in: lpsz="DCSTEJJRTZWI_QDXAZHL", cchLength=0x14 | out: lpsz="DCSTEJJRTZWI_QDXAZHL") returned 0x14 [0083.633] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.633] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.633] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0083.634] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0083.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0xd37250, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoadResource", lpUsedDefaultChar=0x0) returned 13 [0083.634] GetProcAddress (hModule=0x777b0000, lpProcName="LoadResource") returned 0x777f984d [0083.634] LoadResource (hModule=0x0, hResInfo=0x2f74a8) returned 0x2ff508 [0083.634] FreeLibrary (hLibModule=0x777b0000) returned 1 [0083.634] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0083.634] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.634] CharUpperBuffW (in: lpsz="KAMA_G_MVOPZHGX_NHVN", cchLength=0x14 | out: lpsz="KAMA_G_MVOPZHGX_NHVN") returned 0x14 [0083.634] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.635] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0083.635] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0083.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0xd36a88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LockResource", lpUsedDefaultChar=0x0) returned 13 [0083.635] GetProcAddress (hModule=0x777b0000, lpProcName="LockResource") returned 0x777efd29 [0083.635] LockResource (hResData=0x2ff508) returned 0x2ff508 [0083.635] FreeLibrary (hLibModule=0x777b0000) returned 1 [0083.635] CharUpperBuffW (in: lpsz="IQOZHBYWTDLIHUPBFBUV", cchLength=0x14 | out: lpsz="IQOZHBYWTDLIHUPBFBUV") returned 0x14 [0083.635] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0083.636] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0083.636] CharLowerBuffW (in: lpsz="byte[329233]", cchLength=0xc | out: lpsz="byte[329233]") returned 0xc [0083.659] CharUpperBuffW (in: lpsz="DECDATA", cchLength=0x7 | out: lpsz="DECDATA") returned 0x7 [0083.672] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.672] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.672] CharUpperBuffW (in: lpsz="PRWRLUFYJZWBMKYOBTGF", cchLength=0x14 | out: lpsz="PRWRLUFYJZWBMKYOBTGF") returned 0x14 [0083.673] PeekMessageW (in: lpMsg=0x90ecf4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ecf4) returned 0 [0083.673] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.673] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.673] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.673] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.673] CharUpperBuffW (in: lpsz="IDXQIICQQWKNZSJCQWXO", cchLength=0x14 | out: lpsz="IDXQIICQQWKNZSJCQWXO") returned 0x14 [0083.674] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.674] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.674] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.674] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.674] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.674] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.674] CharUpperBuffW (in: lpsz="XWIXBQLSBNHDNALKQPYB", cchLength=0x14 | out: lpsz="XWIXBQLSBNHDNALKQPYB") returned 0x14 [0083.674] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.674] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x2340020, cbMultiByte=658467, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 658467 [0083.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x2340020, cbMultiByte=658467, lpWideCharStr=0x2540020, cchWideChar=658467 | out: lpWideCharStr="0x5FBC5279FFBB4A14E7EF5808CAB5D50DA38AC491F22890CAA7720ACB4B679CBF19629C6F2E09A4689BB245B1AB1CCAE4411D6321E6526DC0375540C76DA9D18611FA292B7AA9441CBC45B7BB6A7E5F35C2920C0620B2C84F76DED5137EF3F7250F5CA14D1AC7C2596B1F3C395448740D77B9FF5783415E585BF3D956AE2F6FC979DE4FD47570A7F3E2C6C194CD11F2A0F4F8AF1CB4029B5728B1E2ED9124C824F62B834BE282CE195D58C039BE00D588403BD4B6B21D33EF8BB45CE1D05829011D6D43F41EF1971B8CB44E0EDD38F5B21F9E40E2D3A24543BE68F6EAEC5111C3E91B4C20894ED7EAD29D95FEFB0EA3F54DC66E61AD5B576D882719A22F6C72E3501F16817D36717BF270500B0DA3C1D9C8E8872DF307DF897F5F9D81CCE8694919C0DE7CA4005FD5451CF840D1EFD86837FCA89E33E5EB4F85515079E2B088D3ECD4596A9519DB62F7029FF84284AA888B1F4AB2128911E9C407D9D8C474ABCF19BBC82C27E1EA121821276C35C57423BC231C7A79E4864EDC44AAB1618D814D72A131CC840D5C56984223D602322F94B708FF5754BBF7C273A5011D01A72448152896B994384C9B8E310A1A998A682AFD286AC73FDD34C5BFC9CE5FF384E74003841F78E592CF1ED831D79D673082076DD46686399F1CC269FECEE421D4E4D6463968F874697012C844258C5FC1698E4DAB86F9750AE14B66BEA0067F71EC7A05BED0D3EEB5C4925927FF44354C58A8D797D31296531A7BFE77775C07D0A459495EDE15DA56F7D93F1AE3E474C2C8F90DBBB1460758ABBF89DCAC3DB4BB53CF6EC09C6560022740DE8321443C4047597F4B507F87219C7768CA364A55E1E0F438E46748DDC93A51EE3889E31993ECED83A2100FE645EE5AC536CC6C968844568D9E5EDF84CF2F45A6679220EAFC4C25C9C7940CF89CEB8DBA0A6C2AB9C5B763A777E8DDFE7F564F1AF85051282C23CBDA3186BC1DB775DA91853331B394BD582EA4D470226C4071D61DBA7DB4D74A70113ABB8EA62F0727913378DB04F0F7A57DA4EC5D910A45D51E6A4BE09AF06FDFA6F3B69330707C045F27BEE25C99B11635002F6A55EC3B6C8339B39EBDB2357FDD1C442290A4A14488E6AA70BF5CF226376B6B8D3744C9B4BBD9083AB724868933D956CDFFD575206844BD6F5056A8767CBE9B33F53DDDA0969A19F8C9CB84104B9BE4846A7E109E766F3A0A19E303F3845BAC101548D5A6B2C62D9C8D0A272B7D69B97CECAB20C36E17A43839772BBE2E9334995A620E4C4EF51D14EAC6CB747ABF3BAE24055B898D4A979C4D44FED3565A3CB300CCAAC4692F2F3F963B1F3207751AABD0DB7AFB87A63DA027D1FD15F6FCDEFB8D93D2AB4C7CC992F35B7B6E8E65EC95870BEC7C8A5CFF9DC497145224B757CDD75F794A74968BE92699600B5F6C9910E4BEC334F38AAAAF3CD319141666A5CAF2E7D9E0B887DEB6F5462BC36F97ADAAA091070EFB53D1487D1332512CF79E96FE9DCE915CC9D09EC91C981988F540F9E21793EE9A4BA58AEB2D71E3DEFFDDE19BC84D94BACA7C6922D4A639591635AD67D467FD045B50D2EC13D593F448C8A829F8AEF3E25ACCA0CBC389F92DEED05AD11F46630BAF365C57F268851CB7D909A7409D486EA57837D39B54A658926A67847EE742431B7158B0896B7F501DC406B7DF04673523B92E47EB5B58CEF2F106F274240BC86C3194B96EB49A0E02E68B942F4D22F869E1008C8C4DC5DFC4E93C142612C4AE42B06CF79F29EA969175BC438E562D46078CFAC536123C05600919A51FB978B77A8C5849769A36DAC2EA6CCBBF856126BC11FF11724CE1A47A6C3D8D87BE5145D2EDED9902772EF55CEF8434DCD8C4E7CDDE02E9EA7CDBD5C7B1F99E6B81F42C63DCF9A6F0B79BB12DCD85333EB5892DD13EB9ED76657427B0D58312EEB5004DCECD7330E3AD178A7C0BAF2F2E1104485D39C9675123047F156AEACBCF709619D4F9530BB81A03CD01016218143DD2B3F866172AE80A14AE87E25AF081A5E6468708331C741F1B35ED5E30983376114616A07286F72E9715EDBE397269CB9B25C16ACCFD015C8FC0BFD7076BA52FAF1C62709252096C202564915D70E3A37FD915C01F39D712030ED9154E91222BD157065E1718B70774C0C48B99055A0C544FF3DA8B18E3E17497441A3996C53180D5A4B384642779C05B9698723D092C8BE8D438BF2F9C5DAB28C6D442F864D53F13EAD8499C26DD7A289CC968A89D4BC4104A23C4839F0BF92E667DB2644E9080E702BC09B3EA5CDE6F5FA6C6DF1BCF60B3BF7809DA61393C36D6F1D09D8A3FCB3C049242D4C9E0157AA85E7A2EA28E28690BA2DBB0BB7F2D0E35F8245EB2555CF3EC3FA7C845D7E3DB20DD03CFECDCD89EBBB998CD15C4DFA93C4D126376A41BBB6C2507EED9B5E0EDB4CDD26BC0163D17EEE656A209C46EA8C8C6CE240927488EEB3F4051BCAA344887DFC73C986BB35C81D5E72EBD822494E741BB749B0E072EBD9F5CE90AF76B78D6AC966D58E4E5D49FE8E3C454CDC1D2C26317AFEED2864147D175814A5A5147C390C88355F098C8F42043990315B92CDF9ACA15BDD56DBD2236A0251D124F1AA3D1701FC03362F43D1A12957A2533954D409F36504E5CC5B3D38D69487DAB030500B5F04CBFC71FBA966376CF37CF3A5FBC15B90E43724BCE32D4F228D20C3CB0E4F3A8D3BB300618E8031D5AFD537EBA8EAB371CCB8F90BCD587E2AEC54A66F489A84434ABAB36C936C38ACAFB15632B62E138CA6AC7E171A71C35C468F9AD3A39E70CC0250C9E9883AF01BF54EFA289CC19422D100C16098C9425CC449008ADCD6DC095D098E6D0AB421DCE0991512992BAF0C215EDCADCFEBF322D777CC86BECBBDA57330D55DC64745DA07604E5EA75240A9FDEA1536E5389007789197220F9E5614CD7B40116D3C772275B4D56C3F3AEB4E1A82A3ED41561F74605BCFECF368637B9C66B0F0989733F4C87A9A4DE27349479D2ED664FADC9E4AFC64912280804869DAD3FC69C994F9CA69FA10F75635B9A62AD8BAAB07995663B086651096B6B70747FA5149F9E6E7840E241AE2F16E3B27AAAD5B653D409F93AF4DBC6015569E305B82E38355A4D5AF1686B27ED5011578A758A1410D10D1262E5AE81AEEF7E8E106B4A815BD7D663FB35FEC96524FC7FADA188E0FD66F1E934079A7BF099C448E4335D4567F4FC79A1562C9B53EFD1B98331B587F58B38C678F6089591161AB8B5845107BC317973FEFCB09830665EC56C8769FA2E89B59AD058B5E9036202B2636E580FC1E643164B1AC6EA294D1B7DDE75940A3406A085D7AD1116258A0CC7443DF90DCE14152EC1B65B0E4AA62D25AF9AB47CA0541E146952BADBCC5BF52C04820EE5C8833CB1DDFC3266BC59415CAE5278CDC1F90ABF4C905DA9D450860BEE7C733798E3923F20E508EE43BD789C3FEC662F5E1A10BBAD7F46D92663862FD1828306F0AB40D489C7A6986021F707FC6851CB46B6E36AC08D8FB228FF98AE2DE1F40914456E983A50A47762B63044B6DAF5DBAD358BCA6BBC22D33F49BBA937B80CA70D060F764323340BD371CEF4ACC4870078750BEDC7A416E381EB6869F5B621C9750C2C83943") returned 658467 [0083.756] CharUpperBuffW (in: lpsz="MMBKMWVJWOGCINWBGHEI", cchLength=0x14 | out: lpsz="MMBKMWVJWOGCINWBGHEI") returned 0x14 [0083.756] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76f70000 [0083.768] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.768] CharUpperBuffW (in: lpsz="SKIRTGLRHOFWUQUUQYOD", cchLength=0x14 | out: lpsz="SKIRTGLRHOFWUQUUQYOD") returned 0x14 [0083.769] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0083.769] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.769] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.769] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.769] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.769] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.769] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.769] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.769] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.769] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.769] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.770] CharUpperBuffW (in: lpsz="BNN_VUOZHLCAXYVQU_RM", cchLength=0x14 | out: lpsz="BNN_VUOZHLCAXYVQU_RM") returned 0x14 [0083.770] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x9deb90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0083.770] GetProcAddress (hModule=0x76f70000, lpProcName="CryptAcquireContext") returned 0x0 [0083.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0083.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x9deb90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0083.770] GetProcAddress (hModule=0x76f70000, lpProcName="CryptAcquireContextA") returned 0x76f791dd [0083.770] CryptAcquireContextA (in: phProv=0x90e9c0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x90e9c0*=0x9ed768) returned 1 [0083.789] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0083.789] PeekMessageW (in: lpMsg=0x90f20c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f20c) returned 0 [0083.789] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.789] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0083.789] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.789] CharUpperBuffW (in: lpsz="ABKWPVNUENAVQACYEFTI", cchLength=0x14 | out: lpsz="ABKWPVNUENAVQACYEFTI") returned 0x14 [0083.790] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.790] CharUpperBuffW (in: lpsz="PKQYPLUXIWNVIUIEYBXY", cchLength=0x14 | out: lpsz="PKQYPLUXIWNVIUIEYBXY") returned 0x14 [0083.790] CharUpperBuffW (in: lpsz="KNNAIYDHZSRCVRFNBHZF", cchLength=0x14 | out: lpsz="KNNAIYDHZSRCVRFNBHZF") returned 0x14 [0083.790] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0083.810] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.810] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.811] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.811] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.811] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.811] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0083.811] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.811] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.811] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xd381f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0083.811] GetProcAddress (hModule=0x76f70000, lpProcName="CryptCreateHash") returned 0x76f7df4e [0083.811] CryptCreateHash (in: hProv=0x9ed768, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x90ea08 | out: phHash=0x90ea08) returned 1 [0083.812] CharUpperBuffW (in: lpsz="JFTVYKADTXOLYOSYZOAY", cchLength=0x14 | out: lpsz="JFTVYKADTXOLYOSYZOAY") returned 0x14 [0083.812] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0083.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0083.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", cchWideChar=51, lpMultiByteStr=0xd319b0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", lpUsedDefaultChar=0x0) returned 51 [0083.812] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0083.812] CharLowerBuffW (in: lpsz="byte[50]", cchLength=0x8 | out: lpsz="byte[50]") returned 0x8 [0083.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0083.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", cchWideChar=51, lpMultiByteStr=0xd319f0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", lpUsedDefaultChar=0x0) returned 51 [0083.812] CharUpperBuffW (in: lpsz="YHNGDJBMMGM_MOVOJOFD", cchLength=0x14 | out: lpsz="YHNGDJBMMGM_MOVOJOFD") returned 0x14 [0083.813] CharUpperBuffW (in: lpsz="AWRLSHYJRTOGTGYECYTE", cchLength=0x14 | out: lpsz="AWRLSHYJRTOGTGYECYTE") returned 0x14 [0083.813] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.813] CharUpperBuffW (in: lpsz="TEQWXYVQXQTHQMKGBQMX", cchLength=0x14 | out: lpsz="TEQWXYVQXQTHQMKGBQMX") returned 0x14 [0083.813] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.813] CharUpperBuffW (in: lpsz="_KGEVVOZKJJCBGPELJNU", cchLength=0x14 | out: lpsz="_KGEVVOZKJJCBGPELJNU") returned 0x14 [0083.813] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.813] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.813] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.814] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0083.814] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xd36d10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0083.814] GetProcAddress (hModule=0x76f70000, lpProcName="CryptHashData") returned 0x76f7df36 [0083.814] CryptHashData (hHash=0xd31870, pbData=0xd31930, dwDataLen=0x32, dwFlags=0x0) returned 1 [0083.814] CharUpperBuffW (in: lpsz="HJMKOMUFBVOESN_YGRAC", cchLength=0x14 | out: lpsz="HJMKOMUFBVOESN_YGRAC") returned 0x14 [0083.815] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.815] CharUpperBuffW (in: lpsz="JWHXOPFWQMM_RWIDFEIZ", cchLength=0x14 | out: lpsz="JWHXOPFWQMM_RWIDFEIZ") returned 0x14 [0083.815] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.815] CharUpperBuffW (in: lpsz="PKQYPLUXIWNVIUIEYBXY", cchLength=0x14 | out: lpsz="PKQYPLUXIWNVIUIEYBXY") returned 0x14 [0083.815] CharUpperBuffW (in: lpsz="RKOBNPFBPHXZWQZEEFKL", cchLength=0x14 | out: lpsz="RKOBNPFBPHXZWQZEEFKL") returned 0x14 [0083.815] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.815] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.815] CharUpperBuffW (in: lpsz="SBWDVAJARWXSENESDBPB", cchLength=0x14 | out: lpsz="SBWDVAJARWXSENESDBPB") returned 0x14 [0083.815] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0083.815] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.816] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.816] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0xd37b08, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0083.816] GetProcAddress (hModule=0x76f70000, lpProcName="CryptDeriveKey") returned 0x76fb3188 [0083.816] CryptDeriveKey (in: hProv=0x9ed768, Algid=0x6610, hBaseData=0xd31870, dwFlags=0x1, phKey=0x90ea08 | out: phKey=0x90ea08*=0xd319b0) returned 1 [0083.819] CharUpperBuffW (in: lpsz="NPEGDBGBJXFHDYAVULHL", cchLength=0x14 | out: lpsz="NPEGDBGBJXFHDYAVULHL") returned 0x14 [0083.819] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.819] CharUpperBuffW (in: lpsz="GRPZSIBHHZBJMXFNJCJQ", cchLength=0x14 | out: lpsz="GRPZSIBHHZBJMXFNJCJQ") returned 0x14 [0083.820] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x9df110, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0083.820] GetProcAddress (hModule=0x76f70000, lpProcName="CryptDestroyHash") returned 0x76f7df66 [0083.820] CryptDestroyHash (hHash=0xd31870) returned 1 [0083.820] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0083.832] CharUpperBuffW (in: lpsz="RTVNJRJDKSCKHKDVEEKZ", cchLength=0x14 | out: lpsz="RTVNJRJDKSCKHKDVEEKZ") returned 0x14 [0083.832] CharUpperBuffW (in: lpsz="1000", cchLength=0x4 | out: lpsz="1000") returned 0x4 [0083.832] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0083.833] CharLowerBuffW (in: lpsz="byte[329232]", cchLength=0xc | out: lpsz="byte[329232]") returned 0xc [0083.847] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.847] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0083.865] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.865] CharUpperBuffW (in: lpsz="ZGGVWCXEDJQTJHMNMJGB", cchLength=0x14 | out: lpsz="ZGGVWCXEDJQTJHMNMJGB") returned 0x14 [0083.865] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.865] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.866] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.866] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.866] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.866] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0083.866] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0083.866] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.866] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.866] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.866] CharUpperBuffW (in: lpsz="_KGEVVOZKJJCBGPELJNU", cchLength=0x14 | out: lpsz="_KGEVVOZKJJCBGPELJNU") returned 0x14 [0083.866] CharUpperBuffW (in: lpsz="NVVLEDLWQZQCMBOKPSCF", cchLength=0x14 | out: lpsz="NVVLEDLWQZQCMBOKPSCF") returned 0x14 [0083.879] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDecrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDecrypt", cchWideChar=13, lpMultiByteStr=0xd38360, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDecrypt", lpUsedDefaultChar=0x0) returned 13 [0083.879] GetProcAddress (hModule=0x76f70000, lpProcName="CryptDecrypt") returned 0x76fb3178 [0083.879] CryptDecrypt (in: hKey=0xd319b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1f30568, pdwDataLen=0x90ea20 | out: pbData=0x1f30568, pdwDataLen=0x90ea20) returned 1 [0083.883] CharUpperBuffW (in: lpsz="FMZXLSJHHMLTZENDAMYM", cchLength=0x14 | out: lpsz="FMZXLSJHHMLTZENDAMYM") returned 0x14 [0083.885] PeekMessageW (in: lpMsg=0x90e98c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e98c) returned 0 [0083.885] CharUpperBuffW (in: lpsz="GOQEEHSMEPRUOBDQKWUP", cchLength=0x14 | out: lpsz="GOQEEHSMEPRUOBDQKWUP") returned 0x14 [0083.885] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0083.885] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.885] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0083.885] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0083.885] CharLowerBuffW (in: lpsz="byte[329216]", cchLength=0xc | out: lpsz="byte[329216]") returned 0xc [0083.885] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.885] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0083.889] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.889] CharUpperBuffW (in: lpsz="FBNVQRDBUQMRSQUPZEVG", cchLength=0x14 | out: lpsz="FBNVQRDBUQMRSQUPZEVG") returned 0x14 [0083.889] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.889] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0xd37a90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.889] GetProcAddress (hModule=0x76f70000, lpProcName="CryptDestroyKey") returned 0x76f7c51a [0083.889] CryptDestroyKey (hKey=0xd319b0) returned 1 [0083.889] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.889] CharUpperBuffW (in: lpsz="FBNVQRDBUQMRSQUPZEVG", cchLength=0x14 | out: lpsz="FBNVQRDBUQMRSQUPZEVG") returned 0x14 [0083.890] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.890] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0xd36a58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.890] GetProcAddress (hModule=0x76f70000, lpProcName="CryptDestroyKey") returned 0x76f7c51a [0083.890] CryptDestroyKey (hKey=0xd319b0) returned 0 [0083.890] CharUpperBuffW (in: lpsz="PHJZQBHGBLSQFJXCPK_M", cchLength=0x14 | out: lpsz="PHJZQBHGBLSQFJXCPK_M") returned 0x14 [0083.890] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0083.890] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0083.891] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0083.891] CharUpperBuffW (in: lpsz="ECKMEMCHDOSIWWCIKFWC", cchLength=0x14 | out: lpsz="ECKMEMCHDOSIWWCIKFWC") returned 0x14 [0083.891] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0083.891] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0083.891] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0083.906] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0083.906] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x9df130, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.906] GetProcAddress (hModule=0x76f70000, lpProcName="CryptReleaseContext") returned 0x76f7e124 [0083.906] CryptReleaseContext (hProv=0x9ed768, dwFlags=0x0) returned 1 [0083.906] FreeLibrary (hLibModule=0x76f70000) returned 1 [0083.906] CharUpperBuffW (in: lpsz="EBHLYPIUKAVZA_OGNFLT", cchLength=0x14 | out: lpsz="EBHLYPIUKAVZA_OGNFLT") returned 0x14 [0083.964] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x90ee70 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0083.964] CharUpperBuffW (in: lpsz="TPAGBHUBMCHOAAR", cchLength=0xf | out: lpsz="TPAGBHUBMCHOAAR") returned 0xf [0083.964] CharUpperBuffW (in: lpsz="PGDJXQUTWMMUIQOFFEWQ", cchLength=0x14 | out: lpsz="PGDJXQUTWMMUIQOFFEWQ") returned 0x14 [0083.965] CharUpperBuffW (in: lpsz="LAJPUUBTAUPYKYTXN", cchLength=0x11 | out: lpsz="LAJPUUBTAUPYKYTXN") returned 0x11 [0084.114] CharUpperBuffW (in: lpsz="TMSKQOPVNSFXQQUYIFSK", cchLength=0x14 | out: lpsz="TMSKQOPVNSFXQQUYIFSK") returned 0x14 [0084.114] PeekMessageW (in: lpMsg=0x90e3ac, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3ac) returned 0 [0084.115] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0084.122] CharUpperBuffW (in: lpsz="YUXQUJTAPNSAJSQQGRCF", cchLength=0x14 | out: lpsz="YUXQUJTAPNSAJSQQGRCF") returned 0x14 [0084.127] PeekMessageW (in: lpMsg=0x90e3ac, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3ac) returned 0 [0084.127] CharUpperBuffW (in: lpsz="ZYQMYIHPZIAQJHXMDIAJ", cchLength=0x14 | out: lpsz="ZYQMYIHPZIAQJHXMDIAJ") returned 0x14 [0084.128] PeekMessageW (in: lpMsg=0x90e3ac, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3ac) returned 0 [0084.137] PeekMessageW (in: lpMsg=0x90e3ac, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3ac) returned 0 [0084.137] CharUpperBuffW (in: lpsz="ANGILWRLDVDE_PXWBSEL", cchLength=0x14 | out: lpsz="ANGILWRLDVDE_PXWBSEL") returned 0x14 [0084.139] PeekMessageW (in: lpMsg=0x90e3ac, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3ac) returned 0 [0084.139] PeekMessageW (in: lpMsg=0x90e3ac, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3ac) returned 0 [0084.140] CharUpperBuffW (in: lpsz="CRQEQZZLGAEPYQKCYUVH", cchLength=0x14 | out: lpsz="CRQEQZZLGAEPYQKCYUVH") returned 0x14 [0084.144] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.145] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.145] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.146] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.147] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0084.148] GetWindowTextW (in: hWnd=0x10066, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.148] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.148] GetWindowTextW (in: hWnd=0x10064, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.148] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.148] GetWindowTextW (in: hWnd=0x10050, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.148] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.148] GetWindowTextW (in: hWnd=0x10078, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.149] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.149] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.149] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.149] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.149] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.149] GetWindowTextW (in: hWnd=0x10068, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.149] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.149] GetWindowTextW (in: hWnd=0x10048, lpString=0x90de38, nMaxCount=1024 | out: lpString="Start") returned 5 [0084.149] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0084.149] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.149] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0084.149] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0084.150] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0084.150] GetWindowTextW (in: hWnd=0x10114, lpString=0x90de38, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0084.150] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0084.150] GetWindowTextW (in: hWnd=0x100da, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.150] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.151] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.151] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.151] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.151] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.152] GetWindowTextW (in: hWnd=0x10094, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.152] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.152] GetWindowTextW (in: hWnd=0x50082, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.152] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.152] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.152] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0084.152] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90de38, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0084.152] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0084.153] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.153] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0084.157] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.157] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0084.157] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90de38, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0084.157] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0084.157] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90de38, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0084.157] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90de38) returned 0x9 [0084.160] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0084.160] GetWindowTextW (in: hWnd=0x10244, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.161] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.161] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90de38, nMaxCount=1024 | out: lpString="C") returned 1 [0084.161] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0084.161] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.161] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0084.161] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90de38, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0084.161] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0084.161] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90de38, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0084.161] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0084.161] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90de38, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0084.161] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0084.161] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.161] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0084.161] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.161] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0084.161] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.161] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0084.161] GetWindowTextW (in: hWnd=0x20198, lpString=0x90de38, nMaxCount=1024 | out: lpString="Oil") returned 3 [0084.161] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0084.161] GetWindowTextW (in: hWnd=0x20178, lpString=0x90de38, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0084.161] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0084.161] GetWindowTextW (in: hWnd=0x20176, lpString=0x90de38, nMaxCount=1024 | out: lpString="Runner") returned 6 [0084.161] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0084.161] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90de38, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0084.161] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0084.161] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0084.161] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0084.161] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90de38, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0084.162] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0084.162] GetWindowTextW (in: hWnd=0x30188, lpString=0x90de38, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0084.162] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0084.162] GetWindowTextW (in: hWnd=0x20164, lpString=0x90de38, nMaxCount=1024 | out: lpString="Charging") returned 8 [0084.162] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0084.162] GetWindowTextW (in: hWnd=0x20160, lpString=0x90de38, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0084.162] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0084.162] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0084.162] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0084.162] GetWindowTextW (in: hWnd=0x20158, lpString=0x90de38, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0084.162] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0084.162] GetWindowTextW (in: hWnd=0x40152, lpString=0x90de38, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0084.162] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0084.162] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0084.162] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0084.162] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90de38, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0084.162] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0084.162] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90de38, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0084.162] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0084.162] GetWindowTextW (in: hWnd=0x30174, lpString=0x90de38, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0084.162] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0084.162] GetWindowTextW (in: hWnd=0x20148, lpString=0x90de38, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0084.162] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0084.162] GetWindowTextW (in: hWnd=0x20142, lpString=0x90de38, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0084.162] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0084.162] GetWindowTextW (in: hWnd=0x30144, lpString=0x90de38, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0084.162] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0084.163] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90de38, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0084.163] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0084.163] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90de38, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0084.163] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0084.163] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90de38, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0084.163] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0084.163] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.163] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0084.163] GetWindowTextW (in: hWnd=0x101be, lpString=0x90de38, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0084.163] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0084.163] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90de38, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0084.163] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0084.163] GetWindowTextW (in: hWnd=0x10128, lpString=0x90de38, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0084.163] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0084.163] GetWindowTextW (in: hWnd=0x20126, lpString=0x90de38, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0084.163] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0084.163] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.163] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0084.163] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0084.163] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0084.163] GetWindowTextW (in: hWnd=0x10102, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.163] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0084.163] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90de38, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0084.163] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0084.163] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.163] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.163] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.163] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.164] GetWindowTextW (in: hWnd=0x20034, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.164] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.164] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0084.164] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0084.164] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.164] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.164] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.164] GetWindowTextW (in: hWnd=0x10086, lpString=0x90de38, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0084.164] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0084.164] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0084.164] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0084.164] GetWindowTextW (in: hWnd=0x40024, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.164] GetWindowTextW (in: hWnd=0x10072, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.164] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.164] GetWindowTextW (in: hWnd=0x10058, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.164] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.164] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.164] GetWindowTextW (in: hWnd=0x10054, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.165] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0084.165] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90de38, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0084.165] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0084.165] GetWindowTextW (in: hWnd=0x30028, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.165] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0084.165] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.165] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0084.165] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90de38, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0084.165] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0084.165] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90de38, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0084.165] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0084.165] GetWindowTextW (in: hWnd=0x10036, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.165] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0084.165] GetWindowTextW (in: hWnd=0x30026, lpString=0x90de38, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0084.165] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0084.165] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90de38, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0084.165] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0084.165] GetWindowTextW (in: hWnd=0x20020, lpString=0x90de38, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0084.165] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0084.165] GetWindowTextW (in: hWnd=0x20022, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.165] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.165] GetWindowTextW (in: hWnd=0x10116, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.165] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.165] GetWindowTextW (in: hWnd=0x20208, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.165] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.165] GetWindowTextW (in: hWnd=0x101de, lpString=0x90de38, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0084.165] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0084.165] GetWindowTextW (in: hWnd=0x40184, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x20206, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x20182, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x20180, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x20170, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x20168, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x20166, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x20162, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x20156, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.166] GetWindowTextW (in: hWnd=0x40150, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.166] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x20172, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x20146, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x30140, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x20154, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x10104, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x10030, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.167] GetWindowTextW (in: hWnd=0x10038, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.167] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.168] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90de38, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0084.168] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0084.168] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.168] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.168] CharUpperBuffW (in: lpsz="HAMOKBAMRNQLQWNMQBAB", cchLength=0x14 | out: lpsz="HAMOKBAMRNQLQWNMQBAB") returned 0x14 [0084.171] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.171] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.172] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0084.172] GetWindowTextW (in: hWnd=0x10066, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.172] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.172] GetWindowTextW (in: hWnd=0x10064, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.172] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.172] GetWindowTextW (in: hWnd=0x10050, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.172] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.172] GetWindowTextW (in: hWnd=0x10078, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.172] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.172] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.172] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.172] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.172] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.172] GetWindowTextW (in: hWnd=0x10068, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.172] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.172] GetWindowTextW (in: hWnd=0x10048, lpString=0x90de38, nMaxCount=1024 | out: lpString="Start") returned 5 [0084.172] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0084.172] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.172] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0084.172] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0084.172] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0084.172] GetWindowTextW (in: hWnd=0x10114, lpString=0x90de38, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0084.172] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0084.172] GetWindowTextW (in: hWnd=0x100da, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.172] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.172] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.172] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.172] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.173] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.173] GetWindowTextW (in: hWnd=0x10094, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.173] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.173] GetWindowTextW (in: hWnd=0x50082, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.173] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.173] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.173] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0084.173] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90de38, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0084.173] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0084.173] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.173] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0084.173] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.173] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0084.173] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90de38, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0084.173] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0084.173] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90de38, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0084.173] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90de38) returned 0x9 [0084.173] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0084.173] GetWindowTextW (in: hWnd=0x10244, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.173] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.173] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90de38, nMaxCount=1024 | out: lpString="C") returned 1 [0084.173] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0084.173] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.173] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0084.173] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90de38, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0084.173] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0084.173] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90de38, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0084.173] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0084.173] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90de38, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0084.173] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0084.173] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.174] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0084.174] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.174] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0084.174] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.174] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0084.174] GetWindowTextW (in: hWnd=0x20198, lpString=0x90de38, nMaxCount=1024 | out: lpString="Oil") returned 3 [0084.174] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0084.174] GetWindowTextW (in: hWnd=0x20178, lpString=0x90de38, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0084.174] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0084.174] GetWindowTextW (in: hWnd=0x20176, lpString=0x90de38, nMaxCount=1024 | out: lpString="Runner") returned 6 [0084.174] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0084.174] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90de38, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0084.174] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0084.174] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0084.174] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0084.174] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90de38, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0084.174] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0084.174] GetWindowTextW (in: hWnd=0x30188, lpString=0x90de38, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0084.174] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0084.174] GetWindowTextW (in: hWnd=0x20164, lpString=0x90de38, nMaxCount=1024 | out: lpString="Charging") returned 8 [0084.174] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0084.174] GetWindowTextW (in: hWnd=0x20160, lpString=0x90de38, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0084.174] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0084.174] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0084.174] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0084.174] GetWindowTextW (in: hWnd=0x20158, lpString=0x90de38, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0084.174] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0084.174] GetWindowTextW (in: hWnd=0x40152, lpString=0x90de38, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0084.174] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0084.174] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0084.174] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0084.175] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90de38, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0084.175] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0084.175] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90de38, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0084.175] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0084.175] GetWindowTextW (in: hWnd=0x30174, lpString=0x90de38, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0084.175] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0084.175] GetWindowTextW (in: hWnd=0x20148, lpString=0x90de38, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0084.175] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0084.175] GetWindowTextW (in: hWnd=0x20142, lpString=0x90de38, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0084.175] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0084.175] GetWindowTextW (in: hWnd=0x30144, lpString=0x90de38, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0084.175] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0084.175] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90de38, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0084.175] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0084.175] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90de38, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0084.175] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0084.175] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90de38, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0084.175] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0084.175] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.175] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0084.175] GetWindowTextW (in: hWnd=0x101be, lpString=0x90de38, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0084.175] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0084.175] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90de38, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0084.175] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0084.175] GetWindowTextW (in: hWnd=0x10128, lpString=0x90de38, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0084.175] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0084.175] GetWindowTextW (in: hWnd=0x20126, lpString=0x90de38, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0084.175] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0084.175] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.175] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0084.175] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0084.176] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0084.176] GetWindowTextW (in: hWnd=0x10102, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0084.176] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90de38, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0084.176] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0084.176] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.176] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.176] GetWindowTextW (in: hWnd=0x20034, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.176] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.176] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0084.176] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0084.176] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.176] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.176] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.176] GetWindowTextW (in: hWnd=0x10086, lpString=0x90de38, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0084.176] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0084.176] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0084.176] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0084.176] GetWindowTextW (in: hWnd=0x40024, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.176] GetWindowTextW (in: hWnd=0x10072, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.176] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.177] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.177] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.177] GetWindowTextW (in: hWnd=0x10058, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.177] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.177] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.177] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0084.177] GetWindowTextW (in: hWnd=0x10054, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.177] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0084.177] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90de38, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0084.177] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0084.177] GetWindowTextW (in: hWnd=0x30028, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.177] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0084.177] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.177] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0084.177] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90de38, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0084.177] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0084.177] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90de38, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0084.177] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0084.177] GetWindowTextW (in: hWnd=0x10036, lpString=0x90de38, nMaxCount=1024 | out: lpString="") returned 0 [0084.177] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0084.177] GetWindowTextW (in: hWnd=0x30026, lpString=0x90de38, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0084.177] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0084.177] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90de38, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0084.177] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0084.177] GetWindowTextW (in: hWnd=0x20020, lpString=0x90de38, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0084.177] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0084.177] GetWindowTextW (in: hWnd=0x20022, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.177] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.177] GetWindowTextW (in: hWnd=0x10116, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.177] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.177] GetWindowTextW (in: hWnd=0x20208, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.177] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x101de, lpString=0x90de38, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0084.178] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0084.178] GetWindowTextW (in: hWnd=0x40184, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x20206, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x20182, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x20180, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x20170, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x20168, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x20166, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x20162, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x20156, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.178] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.178] GetWindowTextW (in: hWnd=0x40150, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x20172, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x20146, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x30140, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x20154, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x10104, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x10030, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x10038, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.179] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.179] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90de38, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0084.180] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0084.180] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90de38, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0084.180] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90de38, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0084.180] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0084.180] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0084.180] CharUpperBuffW (in: lpsz="JISHSAQNRFCRNIRYGBOZ", cchLength=0x14 | out: lpsz="JISHSAQNRFCRNIRYGBOZ") returned 0x14 [0084.180] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0084.181] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0084.181] CharUpperBuffW (in: lpsz="JHEUBZNWULMCVYSZIWHO", cchLength=0x14 | out: lpsz="JHEUBZNWULMCVYSZIWHO") returned 0x14 [0084.181] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0084.181] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0084.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0xd373d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceW", lpUsedDefaultChar=0x0) returned 14 [0084.182] GetProcAddress (hModule=0x777b0000, lpProcName="FindResourceW") returned 0x777f3e61 [0084.183] FindResourceW (hModule=0x0, lpName="gwnxfbycxsvu", lpType=0xa) returned 0x2f74b8 [0084.183] FreeLibrary (hLibModule=0x777b0000) returned 1 [0084.183] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0084.183] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0084.183] CharUpperBuffW (in: lpsz="LZXDYKDLWYEUUZHLDWMY", cchLength=0x14 | out: lpsz="LZXDYKDLWYEUUZHLDWMY") returned 0x14 [0084.183] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.184] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0084.184] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0084.184] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0084.184] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0084.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0xd36e30, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SizeofResource", lpUsedDefaultChar=0x0) returned 15 [0084.184] GetProcAddress (hModule=0x777b0000, lpProcName="SizeofResource") returned 0x777f3e7f [0084.184] SizeofResource (hModule=0x0, hResInfo=0x2f74b8) returned 0x13d984 [0084.184] FreeLibrary (hLibModule=0x777b0000) returned 1 [0084.184] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0084.185] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0084.185] CharUpperBuffW (in: lpsz="DCSTEJJRTZWI_QDXAZHL", cchLength=0x14 | out: lpsz="DCSTEJJRTZWI_QDXAZHL") returned 0x14 [0084.210] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.212] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.216] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.216] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0084.216] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0084.216] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0084.216] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0084.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0xd36d10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoadResource", lpUsedDefaultChar=0x0) returned 13 [0084.217] GetProcAddress (hModule=0x777b0000, lpProcName="LoadResource") returned 0x777f984d [0084.217] LoadResource (hModule=0x0, hResInfo=0x2f74b8) returned 0x34fb1c [0084.217] FreeLibrary (hLibModule=0x777b0000) returned 1 [0084.217] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0084.217] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0084.217] CharUpperBuffW (in: lpsz="KAMA_G_MVOPZHGX_NHVN", cchLength=0x14 | out: lpsz="KAMA_G_MVOPZHGX_NHVN") returned 0x14 [0084.220] PeekMessageW (in: lpMsg=0x90e3e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e3e4) returned 0 [0084.220] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0084.220] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0084.220] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0084.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0xd37718, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LockResource", lpUsedDefaultChar=0x0) returned 13 [0084.221] GetProcAddress (hModule=0x777b0000, lpProcName="LockResource") returned 0x777efd29 [0084.221] LockResource (hResData=0x34fb1c) returned 0x34fb1c [0084.221] FreeLibrary (hLibModule=0x777b0000) returned 1 [0084.221] CharUpperBuffW (in: lpsz="IQOZHBYWTDLIHUPBFBUV", cchLength=0x14 | out: lpsz="IQOZHBYWTDLIHUPBFBUV") returned 0x14 [0084.221] PeekMessageW (in: lpMsg=0x90e834, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e834) returned 0 [0084.221] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0084.221] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0084.221] CharLowerBuffW (in: lpsz="byte[1300868]", cchLength=0xd | out: lpsz="byte[1300868]") returned 0xd [0084.293] CharUpperBuffW (in: lpsz="MKDKEHQRCFIJOLOMLLIZ", cchLength=0x14 | out: lpsz="MKDKEHQRCFIJOLOMLLIZ") returned 0x14 [0084.294] PeekMessageW (in: lpMsg=0x90ec2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec2c) returned 0 [0084.294] CharUpperBuffW (in: lpsz="SCZBIMQEJYZOJTBWPVJI", cchLength=0x14 | out: lpsz="SCZBIMQEJYZOJTBWPVJI") returned 0x14 [0084.294] CharUpperBuffW (in: lpsz="NRCKUIFNZLYKTCMKBAKB", cchLength=0x14 | out: lpsz="NRCKUIFNZLYKTCMKBAKB") returned 0x14 [0084.305] PeekMessageW (in: lpMsg=0x90ec2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec2c) returned 0 [0084.305] CharUpperBuffW (in: lpsz="CUHEVSXEDUELZVLIEXJU", cchLength=0x14 | out: lpsz="CUHEVSXEDUELZVLIEXJU") returned 0x14 [0084.306] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\b106484eb915e4ad6df697dc1442cbff-EDITED.jpg" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\b106484eb915e4ad6df697dc1442cbff-edited.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0084.306] CharUpperBuffW (in: lpsz="HMCGCYHBHXQQEYPKMLVI", cchLength=0x14 | out: lpsz="HMCGCYHBHXQQEYPKMLVI") returned 0x14 [0084.307] PeekMessageW (in: lpMsg=0x90ec2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec2c) returned 0 [0084.351] CloseHandle (hObject=0x118) returned 1 [0084.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files", cchCount1=80, lpString2="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", cchCount2=38) returned 1 [0084.367] CharUpperBuffW (in: lpsz="CUHEVSXEDUELZVLIEXJU", cchLength=0x14 | out: lpsz="CUHEVSXEDUELZVLIEXJU") returned 0x14 [0084.367] ShellExecuteExW (in: pExecInfo=0x90ef20*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\b106484eb915e4ad6df697dc1442cbff-EDITED.jpg", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x90ef20*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\b106484eb915e4ad6df697dc1442cbff-EDITED.jpg", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0084.549] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0084.549] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0084.836] CharUpperBuffW (in: lpsz="VCIKFNQMTNFUTAZVGLPLO", cchLength=0x15 | out: lpsz="VCIKFNQMTNFUTAZVGLPLO") returned 0x15 [0084.836] CharUpperBuffW (in: lpsz="ZWVOLVHCXTTABYIH_QIK", cchLength=0x14 | out: lpsz="ZWVOLVHCXTTABYIH_QIK") returned 0x14 [0084.836] GetFileAttributesW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe")) returned 0x20 [0084.838] CharUpperBuffW (in: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK", cchLength=0x19 | out: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK") returned 0x19 [0084.838] CharUpperBuffW (in: lpsz="ZWVOLVHCXTTABYIH_QIK", cchLength=0x14 | out: lpsz="ZWVOLVHCXTTABYIH_QIK") returned 0x14 [0084.854] PeekMessageW (in: lpMsg=0x90ed9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ed9c) returned 0 [0084.861] CharUpperBuffW (in: lpsz="XLYILFCSTEHTHZTSADPJ", cchLength=0x14 | out: lpsz="XLYILFCSTEHTHZTSADPJ") returned 0x14 [0084.865] PeekMessageW (in: lpMsg=0x90ea9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea9c) returned 0 [0084.867] PeekMessageW (in: lpMsg=0x90ea9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea9c) returned 0 [0084.867] CharUpperBuffW (in: lpsz="EI_ZJHJHDGSHHFEYHFRX", cchLength=0x14 | out: lpsz="EI_ZJHJHDGSHHFEYHFRX") returned 0x14 [0084.871] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.871] CharUpperBuffW (in: lpsz="XPIXFQANNLYBPUUDUPSA", cchLength=0x14 | out: lpsz="XPIXFQANNLYBPUUDUPSA") returned 0x14 [0084.900] PeekMessageW (in: lpMsg=0x90efb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90efb4) returned 0 [0084.900] CharUpperBuffW (in: lpsz="EIIMACLZOHUJRVQLXKFG", cchLength=0x14 | out: lpsz="EIIMACLZOHUJRVQLXKFG") returned 0x14 [0084.910] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.913] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.916] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.916] CharUpperBuffW (in: lpsz="PCGUMOOKRJFEFCWHYTZZ", cchLength=0x14 | out: lpsz="PCGUMOOKRJFEFCWHYTZZ") returned 0x14 [0084.917] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.918] CharUpperBuffW (in: lpsz="BCENHIJFCTHZUGDYGRXX", cchLength=0x14 | out: lpsz="BCENHIJFCTHZUGDYGRXX") returned 0x14 [0084.919] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.924] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.925] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.925] CharUpperBuffW (in: lpsz="RMJFRZCNFYCWWOVLRTXJ", cchLength=0x14 | out: lpsz="RMJFRZCNFYCWWOVLRTXJ") returned 0x14 [0084.925] CharUpperBuffW (in: lpsz="RNUSKUYSEUUNMJEDIIAX", cchLength=0x14 | out: lpsz="RNUSKUYSEUUNMJEDIIAX") returned 0x14 [0084.927] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.933] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.933] CharUpperBuffW (in: lpsz="IHZGGHJPCWWMELTUIIXP", cchLength=0x14 | out: lpsz="IHZGGHJPCWWMELTUIIXP") returned 0x14 [0084.946] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.952] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0084.952] CharUpperBuffW (in: lpsz="PXZUWBABVSZWUCBZYBQX", cchLength=0x14 | out: lpsz="PXZUWBABVSZWUCBZYBQX") returned 0x14 [0084.953] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0084.954] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0084.954] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0084.954] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0084.954] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.954] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0084.954] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.954] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0084.954] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.954] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0084.954] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.954] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0084.954] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.954] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0084.956] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.956] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0084.973] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0084.973] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start") returned 5 [0084.973] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0084.973] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0084.973] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0084.983] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0084.983] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0084.983] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0084.983] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0085.005] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.014] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.016] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.016] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.016] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.016] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.016] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0085.016] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e188, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0085.016] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0085.016] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0085.016] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0085.016] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0085.016] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0085.016] GetWindowTextW (in: hWnd=0x2025c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x2025c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.016] GetWindowTextW (in: hWnd=0x20266, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x20266, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.016] GetWindowTextW (in: hWnd=0x20268, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x20268, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.016] GetWindowTextW (in: hWnd=0x20246, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x20246, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.016] GetWindowTextW (in: hWnd=0x20254, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.016] GetClassNameW (in: hWnd=0x20254, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.017] GetWindowTextW (in: hWnd=0x20250, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.017] GetClassNameW (in: hWnd=0x20250, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.017] GetWindowTextW (in: hWnd=0x2024a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.017] GetClassNameW (in: hWnd=0x2024a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.017] GetWindowTextW (in: hWnd=0x2024c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.017] GetClassNameW (in: hWnd=0x2024c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.017] GetWindowTextW (in: hWnd=0x30130, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0085.017] GetClassNameW (in: hWnd=0x30130, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0085.017] GetWindowTextW (in: hWnd=0x2021e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.017] GetClassNameW (in: hWnd=0x2021e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.017] GetWindowTextW (in: hWnd=0x2020e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.017] GetClassNameW (in: hWnd=0x2020e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.017] GetWindowTextW (in: hWnd=0x20216, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.017] GetClassNameW (in: hWnd=0x20216, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.017] GetWindowTextW (in: hWnd=0x201f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.017] GetClassNameW (in: hWnd=0x201f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0085.017] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0085.017] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e188) returned 0x9 [0085.017] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0085.017] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.017] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.017] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e188, nMaxCount=1024 | out: lpString="C") returned 1 [0085.017] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0085.017] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.017] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0085.017] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0085.017] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0085.017] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0085.017] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0085.017] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0085.017] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0085.018] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.018] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0085.018] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.018] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0085.018] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.018] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0085.018] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e188, nMaxCount=1024 | out: lpString="Oil") returned 3 [0085.018] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0085.018] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e188, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0085.018] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0085.018] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e188, nMaxCount=1024 | out: lpString="Runner") returned 6 [0085.018] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0085.018] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0085.018] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0085.018] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0085.018] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0085.018] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0085.018] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0085.018] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e188, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0085.018] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0085.018] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e188, nMaxCount=1024 | out: lpString="Charging") returned 8 [0085.018] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0085.018] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0085.018] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0085.018] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0085.018] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0085.018] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e188, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0085.018] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0085.018] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e188, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0085.018] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0085.018] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0085.019] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0085.019] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0085.019] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0085.019] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0085.019] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0085.019] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e188, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0085.019] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0085.019] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e188, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0085.019] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0085.019] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e188, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0085.019] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0085.019] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0085.019] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0085.019] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0085.019] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0085.019] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e188, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0085.019] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0085.019] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0085.019] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0085.019] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.019] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0085.019] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0085.019] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0085.019] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e188, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0085.019] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0085.019] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e188, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0085.019] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0085.019] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e188, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0085.019] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0085.019] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0085.020] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0085.020] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0085.020] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0085.020] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0085.020] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0085.020] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.020] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.020] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.020] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.020] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0085.020] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0085.020] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.020] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.020] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.020] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0085.020] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0085.020] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0085.020] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0085.020] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.020] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.021] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.021] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.021] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.021] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.021] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.021] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.021] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.021] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.021] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.021] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0085.021] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0085.021] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0085.021] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.021] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0085.021] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.021] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0085.021] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0085.021] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0085.021] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0085.021] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0085.021] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.021] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0085.021] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e188, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0085.021] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0085.021] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0085.021] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0085.021] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.021] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.021] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.021] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.021] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.021] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.022] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.022] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x301f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x301f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x30200, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x30200, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.022] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.022] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.023] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.023] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.024] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.024] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.024] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.024] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.024] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.024] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.024] PeekMessageW (in: lpMsg=0x90efb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90efb4) returned 0 [0085.024] CharUpperBuffW (in: lpsz="ZEFFQFJWNEFHGNVZTAMA", cchLength=0x14 | out: lpsz="ZEFFQFJWNEFHGNVZTAMA") returned 0x14 [0085.026] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.026] CharUpperBuffW (in: lpsz="QBXIUDLNKEXQURPGRICK", cchLength=0x14 | out: lpsz="QBXIUDLNKEXQURPGRICK") returned 0x14 [0085.027] CharUpperBuffW (in: lpsz="WQWHHTKNXZNMLDWTQSVG", cchLength=0x14 | out: lpsz="WQWHHTKNXZNMLDWTQSVG") returned 0x14 [0085.052] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.058] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.058] CharUpperBuffW (in: lpsz="XJSETJNZVIBNFLHXZOUG", cchLength=0x14 | out: lpsz="XJSETJNZVIBNFLHXZOUG") returned 0x14 [0085.059] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.068] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.069] CharUpperBuffW (in: lpsz="YVWBREMSKTIATHZZAWPW", cchLength=0x14 | out: lpsz="YVWBREMSKTIATHZZAWPW") returned 0x14 [0085.088] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.090] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.090] CharUpperBuffW (in: lpsz="FZUFBWLRBOPBUUHPJQTM", cchLength=0x14 | out: lpsz="FZUFBWLRBOPBUUHPJQTM") returned 0x14 [0085.091] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.093] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.094] CharUpperBuffW (in: lpsz="RFPNQVGXPSVABCODQHCB", cchLength=0x14 | out: lpsz="RFPNQVGXPSVABCODQHCB") returned 0x14 [0085.098] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.103] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.104] CharUpperBuffW (in: lpsz="NWYSKVLJAUVPLQDLFIVF", cchLength=0x14 | out: lpsz="NWYSKVLJAUVPLQDLFIVF") returned 0x14 [0085.105] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.105] CharUpperBuffW (in: lpsz="ZOBCVWKGIFEMUHGZK_YF", cchLength=0x14 | out: lpsz="ZOBCVWKGIFEMUHGZK_YF") returned 0x14 [0085.107] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.107] CharUpperBuffW (in: lpsz="MVIHOZMJVDIPREFGIHCC", cchLength=0x14 | out: lpsz="MVIHOZMJVDIPREFGIHCC") returned 0x14 [0085.107] CharUpperBuffW (in: lpsz="JRU_GOTBXQVDMXCISXWA", cchLength=0x14 | out: lpsz="JRU_GOTBXQVDMXCISXWA") returned 0x14 [0085.108] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.109] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.109] CharUpperBuffW (in: lpsz="PKBZQYQSOVJJWCIRGB_I", cchLength=0x14 | out: lpsz="PKBZQYQSOVJJWCIRGB_I") returned 0x14 [0085.114] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.115] PeekMessageW (in: lpMsg=0x90efb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90efb4) returned 0 [0085.115] CharUpperBuffW (in: lpsz="BICLVWXMDOUIQZWAPWP_", cchLength=0x14 | out: lpsz="BICLVWXMDOUIQZWAPWP_") returned 0x14 [0085.116] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.116] CharUpperBuffW (in: lpsz="NGOVNEWDKTABMVPOPHOQ", cchLength=0x14 | out: lpsz="NGOVNEWDKTABMVPOPHOQ") returned 0x14 [0085.118] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.118] CharUpperBuffW (in: lpsz="MQ_DIPASCWMFVPEARFNV", cchLength=0x14 | out: lpsz="MQ_DIPASCWMFVPEARFNV") returned 0x14 [0085.120] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.121] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.121] CharUpperBuffW (in: lpsz="EV_EDZYHSKAEVNLOCCMD", cchLength=0x14 | out: lpsz="EV_EDZYHSKAEVNLOCCMD") returned 0x14 [0085.122] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0085.122] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.122] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.122] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.122] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.122] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.122] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.122] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.122] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.122] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.122] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.122] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.122] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.122] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.122] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.122] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start") returned 5 [0085.122] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0085.122] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.122] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0085.122] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0085.122] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0085.122] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0085.122] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0085.122] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.122] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.122] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.122] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.123] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.123] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.123] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.123] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0085.123] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e188, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0085.123] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0085.123] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0085.123] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0085.123] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0085.123] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0085.123] GetWindowTextW (in: hWnd=0x20286, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x20286, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.123] GetWindowTextW (in: hWnd=0x2022c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x2022c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.123] GetWindowTextW (in: hWnd=0x301b8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x301b8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.123] GetWindowTextW (in: hWnd=0x3019a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x3019a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.123] GetWindowTextW (in: hWnd=0x20228, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x20228, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.123] GetWindowTextW (in: hWnd=0x20238, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.123] GetClassNameW (in: hWnd=0x20238, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.123] GetWindowTextW (in: hWnd=0x20234, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x20234, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x20220, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x20220, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x2025c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x2025c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x20266, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x20266, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x20268, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x20268, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x20246, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x20246, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x20254, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x20254, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x20250, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x20250, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x2024a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x2024a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x2024c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x2024c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x2021e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x2021e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x2020e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x2020e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x20216, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.124] GetClassNameW (in: hWnd=0x20216, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.124] GetWindowTextW (in: hWnd=0x201f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0085.124] GetClassNameW (in: hWnd=0x201f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0085.124] GetWindowTextW (in: hWnd=0x30130, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0085.124] GetClassNameW (in: hWnd=0x30130, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0085.125] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0085.125] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e188) returned 0x9 [0085.125] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0085.125] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.125] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.125] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e188, nMaxCount=1024 | out: lpString="C") returned 1 [0085.125] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0085.125] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.125] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0085.125] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0085.125] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0085.125] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0085.125] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0085.125] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0085.125] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0085.125] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.125] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0085.125] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.125] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0085.125] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.125] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0085.125] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e188, nMaxCount=1024 | out: lpString="Oil") returned 3 [0085.125] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0085.125] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e188, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0085.125] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0085.125] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e188, nMaxCount=1024 | out: lpString="Runner") returned 6 [0085.125] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0085.125] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0085.125] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0085.125] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0085.125] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0085.126] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0085.126] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0085.126] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e188, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0085.126] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0085.126] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e188, nMaxCount=1024 | out: lpString="Charging") returned 8 [0085.126] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0085.126] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0085.126] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0085.126] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0085.126] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0085.126] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e188, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0085.126] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0085.126] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e188, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0085.126] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0085.126] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0085.126] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0085.126] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0085.126] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0085.126] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0085.126] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0085.126] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e188, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0085.126] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0085.126] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e188, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0085.126] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0085.126] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e188, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0085.126] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0085.126] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0085.126] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0085.126] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0085.126] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0085.127] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e188, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0085.127] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0085.127] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0085.127] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0085.127] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.127] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0085.127] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0085.127] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0085.127] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e188, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0085.127] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0085.127] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e188, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0085.127] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0085.127] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e188, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0085.127] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0085.127] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.127] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0085.127] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0085.127] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0085.127] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.127] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0085.127] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0085.127] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0085.127] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.127] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.127] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.127] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.127] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.127] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.127] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.127] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.128] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0085.128] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0085.128] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.128] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.128] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.128] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0085.128] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0085.128] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0085.128] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0085.128] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.128] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.128] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.128] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.128] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.128] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0085.128] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0085.128] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0085.128] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.128] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0085.128] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.129] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0085.129] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0085.129] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0085.129] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0085.129] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0085.129] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.129] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0085.129] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e188, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0085.129] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0085.129] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0085.129] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0085.129] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.129] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.129] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.129] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.129] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.129] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.129] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.129] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.129] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.129] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.129] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.129] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.129] GetWindowTextW (in: hWnd=0x301f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.129] GetClassNameW (in: hWnd=0x301f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.129] GetWindowTextW (in: hWnd=0x2022e, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.129] GetClassNameW (in: hWnd=0x2022e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.129] GetWindowTextW (in: hWnd=0x30200, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.129] GetClassNameW (in: hWnd=0x30200, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.129] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.130] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.130] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.131] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.131] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.131] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.131] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.132] CharUpperBuffW (in: lpsz="HTWRVULEKT_VERDGTRWH", cchLength=0x14 | out: lpsz="HTWRVULEKT_VERDGTRWH") returned 0x14 [0085.133] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.134] CharUpperBuffW (in: lpsz="LYYDRFOIXUMXJVQVLAHV", cchLength=0x14 | out: lpsz="LYYDRFOIXUMXJVQVLAHV") returned 0x14 [0085.135] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.170] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.170] CharUpperBuffW (in: lpsz="TVYEHKDCOSIGLZCIVOQW", cchLength=0x14 | out: lpsz="TVYEHKDCOSIGLZCIVOQW") returned 0x14 [0085.171] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.172] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.173] CharUpperBuffW (in: lpsz="HOGZIXMXCNXYPWYGIGCP", cchLength=0x14 | out: lpsz="HOGZIXMXCNXYPWYGIGCP") returned 0x14 [0085.175] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.175] CharUpperBuffW (in: lpsz="KZWKYZWVIRRIVMZBYXSW", cchLength=0x14 | out: lpsz="KZWKYZWVIRRIVMZBYXSW") returned 0x14 [0085.176] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0085.219] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0085.219] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0085.219] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.219] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.219] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.219] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.219] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.219] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.219] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.219] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.219] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.219] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.219] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.219] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.219] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.219] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.219] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start") returned 5 [0085.219] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0085.219] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.219] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0085.219] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0085.219] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0085.220] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0085.220] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0085.220] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.220] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.220] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.220] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.220] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.220] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0085.220] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e188, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0085.220] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0085.220] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0085.220] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0085.220] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0085.220] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0085.220] GetWindowTextW (in: hWnd=0x20286, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x20286, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.220] GetWindowTextW (in: hWnd=0x2022c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x2022c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.220] GetWindowTextW (in: hWnd=0x301b8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x301b8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.220] GetWindowTextW (in: hWnd=0x3019a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.220] GetClassNameW (in: hWnd=0x3019a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.220] GetWindowTextW (in: hWnd=0x20228, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x20228, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x20238, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x20238, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x20234, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x20234, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x20220, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x20220, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x2025c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x2025c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x20266, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x20266, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x20268, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x20268, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x20246, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x20246, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x20254, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x20254, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x20250, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x20250, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x2024a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x2024a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x2024c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x2024c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x2021e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x2021e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x2020e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x2020e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x20216, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.221] GetClassNameW (in: hWnd=0x20216, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.221] GetWindowTextW (in: hWnd=0x201f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0085.221] GetClassNameW (in: hWnd=0x201f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0085.222] GetWindowTextW (in: hWnd=0x30130, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0085.222] GetClassNameW (in: hWnd=0x30130, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0085.222] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0085.222] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e188) returned 0x9 [0085.222] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0085.222] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.222] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.222] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e188, nMaxCount=1024 | out: lpString="C") returned 1 [0085.222] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0085.222] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.222] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0085.222] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0085.222] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0085.222] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0085.222] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0085.222] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0085.222] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0085.222] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.222] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0085.222] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.222] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0085.222] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.222] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0085.222] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e188, nMaxCount=1024 | out: lpString="Oil") returned 3 [0085.222] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0085.222] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e188, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0085.222] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0085.222] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e188, nMaxCount=1024 | out: lpString="Runner") returned 6 [0085.222] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0085.222] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0085.222] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0085.223] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0085.223] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0085.223] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0085.223] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0085.223] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e188, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0085.223] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0085.223] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e188, nMaxCount=1024 | out: lpString="Charging") returned 8 [0085.223] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0085.223] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0085.223] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0085.223] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0085.223] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0085.223] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e188, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0085.223] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0085.223] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e188, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0085.223] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0085.223] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0085.223] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0085.223] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0085.223] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0085.223] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0085.223] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0085.223] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e188, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0085.223] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0085.223] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e188, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0085.223] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0085.223] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e188, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0085.223] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0085.223] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0085.223] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0085.223] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0085.224] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0085.224] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e188, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0085.224] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0085.224] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0085.224] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0085.224] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.224] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0085.224] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0085.224] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0085.224] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e188, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0085.224] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0085.224] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e188, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0085.224] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0085.224] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e188, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0085.224] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0085.224] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.224] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0085.224] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0085.224] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0085.224] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.224] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0085.224] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0085.224] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0085.224] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.224] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.224] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.224] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.224] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.224] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.224] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.224] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.225] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0085.225] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0085.225] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.225] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.225] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.225] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0085.225] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0085.225] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0085.225] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0085.225] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.225] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.225] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.225] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0085.225] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0085.225] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0085.225] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0085.225] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0085.225] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0085.225] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.225] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0085.226] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0085.226] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0085.226] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0085.226] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0085.226] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0085.226] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0085.226] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e188, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0085.226] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0085.226] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0085.226] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0085.226] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.226] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.226] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.226] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.226] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.226] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.226] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.226] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.226] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.226] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.226] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.226] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.226] GetWindowTextW (in: hWnd=0x301f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.226] GetClassNameW (in: hWnd=0x301f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.226] GetWindowTextW (in: hWnd=0x2022e, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.226] GetClassNameW (in: hWnd=0x2022e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.226] GetWindowTextW (in: hWnd=0x30200, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.226] GetClassNameW (in: hWnd=0x30200, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.226] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.226] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.227] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.227] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0085.228] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0085.228] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0085.228] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0085.228] CharUpperBuffW (in: lpsz="ECIEUQIYMORRJKVXPJYB", cchLength=0x14 | out: lpsz="ECIEUQIYMORRJKVXPJYB") returned 0x14 [0085.296] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.297] CharUpperBuffW (in: lpsz="OBTNOAZZXFULCMTMDWVU", cchLength=0x14 | out: lpsz="OBTNOAZZXFULCMTMDWVU") returned 0x14 [0085.343] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.420] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 1 [0085.420] TranslateMessage (lpMsg=0x90e6fc) returned 0 [0085.420] DispatchMessageW (lpMsg=0x90e6fc) returned 0x0 [0085.420] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0085.420] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0085.420] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0085.421] CharUpperBuffW (in: lpsz="OVZCBZ_ZLJOLCXZNJUAW", cchLength=0x14 | out: lpsz="OVZCBZ_ZLJOLCXZNJUAW") returned 0x14 [0085.499] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.576] PeekMessageW (in: lpMsg=0x90efb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90efb4) returned 0 [0085.576] CharUpperBuffW (in: lpsz="YAMNUZUSFDKZQATHZZSQ", cchLength=0x14 | out: lpsz="YAMNUZUSFDKZQATHZZSQ") returned 0x14 [0085.623] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.716] PeekMessageW (in: lpMsg=0x90efb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90efb4) returned 0 [0085.716] CharUpperBuffW (in: lpsz="LQUJGTPA_PUCQRQEZQFH", cchLength=0x14 | out: lpsz="LQUJGTPA_PUCQRQEZQFH") returned 0x14 [0085.763] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0085.763] CharUpperBuffW (in: lpsz="QIEAJZQSPPEKWQMBLGHC", cchLength=0x14 | out: lpsz="QIEAJZQSPPEKWQMBLGHC") returned 0x14 [0085.810] PeekMessageW (in: lpMsg=0x90ea9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea9c) returned 0 [0085.854] PeekMessageW (in: lpMsg=0x90ea9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea9c) returned 0 [0085.854] CharUpperBuffW (in: lpsz="MLFUNICGBIPLKOZZMRLD", cchLength=0x14 | out: lpsz="MLFUNICGBIPLKOZZMRLD") returned 0x14 [0085.987] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.029] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.029] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0086.029] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.029] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.029] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.029] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.029] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.029] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.029] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.029] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.029] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.029] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.029] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.029] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.029] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.029] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.029] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start") returned 5 [0086.029] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0086.030] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0086.030] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0086.030] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0086.030] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0086.030] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0086.030] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.030] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.030] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.030] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.030] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.030] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0086.030] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e188, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0086.030] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0086.030] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0086.030] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0086.030] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0086.030] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0086.030] GetWindowTextW (in: hWnd=0x20286, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x20286, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.030] GetWindowTextW (in: hWnd=0x2022c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.030] GetClassNameW (in: hWnd=0x2022c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x301b8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x301b8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x3019a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x3019a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x20228, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x20228, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x20238, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x20238, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x20234, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x20234, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x20220, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x20220, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x2025c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x2025c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x20266, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x20266, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x20268, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x20268, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x20246, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x20246, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x20254, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x20254, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x20250, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x20250, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x2024a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x2024a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x2024c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x2024c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x2021e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.031] GetClassNameW (in: hWnd=0x2021e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.031] GetWindowTextW (in: hWnd=0x2020e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.032] GetClassNameW (in: hWnd=0x2020e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.032] GetWindowTextW (in: hWnd=0x20216, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.032] GetClassNameW (in: hWnd=0x20216, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.032] GetWindowTextW (in: hWnd=0x201f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0086.032] GetClassNameW (in: hWnd=0x201f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0086.032] GetWindowTextW (in: hWnd=0x30130, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.032] GetClassNameW (in: hWnd=0x30130, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.032] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0086.032] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e188) returned 0x9 [0086.032] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0086.032] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.032] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.032] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e188, nMaxCount=1024 | out: lpString="C") returned 1 [0086.032] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0086.032] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.032] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0086.032] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0086.032] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0086.032] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0086.032] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0086.032] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.032] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.032] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.032] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0086.032] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.032] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0086.032] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.032] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0086.032] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e188, nMaxCount=1024 | out: lpString="Oil") returned 3 [0086.032] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0086.033] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e188, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0086.033] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0086.033] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e188, nMaxCount=1024 | out: lpString="Runner") returned 6 [0086.033] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0086.033] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0086.033] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0086.033] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0086.033] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0086.033] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0086.033] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0086.033] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e188, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0086.033] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0086.033] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e188, nMaxCount=1024 | out: lpString="Charging") returned 8 [0086.033] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0086.033] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0086.033] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0086.033] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0086.033] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0086.033] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e188, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0086.033] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0086.033] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e188, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0086.033] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0086.033] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0086.033] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0086.033] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0086.033] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0086.033] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0086.033] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0086.033] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e188, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0086.033] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0086.033] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e188, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0086.033] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0086.034] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e188, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0086.034] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0086.034] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0086.034] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0086.034] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0086.034] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0086.034] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e188, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0086.034] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0086.034] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.034] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.034] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.034] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0086.034] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0086.034] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0086.034] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e188, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0086.034] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0086.034] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e188, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0086.034] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0086.034] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e188, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0086.034] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0086.034] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.034] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0086.034] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0086.034] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0086.034] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.034] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0086.034] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0086.034] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0086.034] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.034] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.035] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.035] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.035] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.035] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0086.035] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0086.035] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.035] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.035] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.035] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0086.035] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0086.035] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0086.035] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0086.035] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.035] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.035] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.035] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.035] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.035] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.036] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.036] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0086.036] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0086.036] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0086.036] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.036] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0086.036] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.036] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0086.036] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0086.036] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0086.036] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0086.036] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0086.036] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.036] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0086.036] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e188, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0086.036] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0086.036] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0086.036] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0086.036] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.036] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.036] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.036] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.036] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.036] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.036] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.036] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.036] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.036] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.036] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.036] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.036] GetWindowTextW (in: hWnd=0x301f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.036] GetClassNameW (in: hWnd=0x301f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x2022e, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.037] GetClassNameW (in: hWnd=0x2022e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.037] GetWindowTextW (in: hWnd=0x30200, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x30200, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.037] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.037] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.038] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.038] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.038] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.038] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.039] CharUpperBuffW (in: lpsz="IQINDKZDOBQHATSHIFSD", cchLength=0x14 | out: lpsz="IQINDKZDOBQHATSHIFSD") returned 0x14 [0086.145] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.145] CharUpperBuffW (in: lpsz="XUBBQHPLBBZYWTXMJXUT", cchLength=0x14 | out: lpsz="XUBBQHPLBBZYWTXMJXUT") returned 0x14 [0086.146] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.146] CharUpperBuffW (in: lpsz="SLUBUVNKCZVYRBQSJICA", cchLength=0x14 | out: lpsz="SLUBUVNKCZVYRBQSJICA") returned 0x14 [0086.173] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.173] PeekMessageW (in: lpMsg=0x90efb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90efb4) returned 0 [0086.173] CharUpperBuffW (in: lpsz="VFFBUHEXEVO_RBQB_XAI", cchLength=0x14 | out: lpsz="VFFBUHEXEVO_RBQB_XAI") returned 0x14 [0086.174] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.178] CharUpperBuffW (in: lpsz="CJJOMNXLLWQZOOHCGPPV", cchLength=0x14 | out: lpsz="CJJOMNXLLWQZOOHCGPPV") returned 0x14 [0086.187] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0086.187] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.187] CharUpperBuffW (in: lpsz="OJJUCOOVWBYRNRBQDNXP", cchLength=0x14 | out: lpsz="OJJUCOOVWBYRNRBQDNXP") returned 0x14 [0086.202] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.209] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.214] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.222] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.224] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.225] CharUpperBuffW (in: lpsz="XCIRFXXXJHSDXJWXLYRP", cchLength=0x14 | out: lpsz="XCIRFXXXJHSDXJWXLYRP") returned 0x14 [0086.228] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.235] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.238] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.239] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.241] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.242] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.252] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0086.254] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.254] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.259] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.260] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.260] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.261] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.263] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.264] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.265] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.265] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.265] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.265] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.265] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.265] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.265] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start") returned 5 [0086.265] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0086.265] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.265] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0086.265] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0086.265] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0086.265] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0086.265] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0086.265] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.265] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.265] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.265] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.265] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.265] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.265] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.265] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.265] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.266] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0086.266] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e188, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0086.266] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0086.266] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0086.266] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0086.266] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0086.266] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0086.266] GetWindowTextW (in: hWnd=0x20286, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x20286, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.266] GetWindowTextW (in: hWnd=0x2022c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x2022c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.266] GetWindowTextW (in: hWnd=0x301b8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x301b8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.266] GetWindowTextW (in: hWnd=0x3019a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x3019a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.266] GetWindowTextW (in: hWnd=0x20228, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x20228, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.266] GetWindowTextW (in: hWnd=0x20238, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x20238, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.266] GetWindowTextW (in: hWnd=0x20234, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x20234, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.266] GetWindowTextW (in: hWnd=0x20220, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.266] GetClassNameW (in: hWnd=0x20220, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x2025c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x2025c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x20266, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x20266, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x20268, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x20268, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x20246, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x20246, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x20254, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x20254, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x20250, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x20250, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x2024a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x2024a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x2024c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x2024c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x2021e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x2021e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x2020e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x2020e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x20216, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.267] GetClassNameW (in: hWnd=0x20216, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.267] GetWindowTextW (in: hWnd=0x201f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0086.267] GetClassNameW (in: hWnd=0x201f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0086.267] GetWindowTextW (in: hWnd=0x30130, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.267] GetClassNameW (in: hWnd=0x30130, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.267] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0086.267] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e188) returned 0x9 [0086.267] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0086.267] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.268] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.268] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e188, nMaxCount=1024 | out: lpString="C") returned 1 [0086.268] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0086.268] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.268] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0086.268] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0086.268] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0086.268] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0086.268] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0086.268] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.268] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.268] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.268] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0086.268] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.268] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0086.268] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.268] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0086.268] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e188, nMaxCount=1024 | out: lpString="Oil") returned 3 [0086.268] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0086.268] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e188, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0086.268] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0086.268] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e188, nMaxCount=1024 | out: lpString="Runner") returned 6 [0086.268] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0086.268] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0086.268] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0086.268] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0086.268] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0086.268] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0086.268] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0086.268] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e188, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0086.268] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0086.268] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e188, nMaxCount=1024 | out: lpString="Charging") returned 8 [0086.269] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0086.269] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0086.269] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0086.269] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0086.269] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0086.269] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e188, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0086.269] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0086.269] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e188, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0086.269] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0086.269] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0086.269] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0086.269] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0086.269] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0086.269] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0086.269] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0086.269] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e188, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0086.269] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0086.269] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e188, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0086.269] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0086.269] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e188, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0086.269] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0086.269] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0086.269] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0086.269] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0086.269] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0086.269] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e188, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0086.269] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0086.269] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.269] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.269] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.269] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0086.270] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0086.270] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0086.270] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e188, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0086.270] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0086.270] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e188, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0086.270] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0086.270] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e188, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0086.270] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0086.270] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.270] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0086.270] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0086.270] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0086.270] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.270] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0086.270] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0086.270] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0086.270] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.270] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.270] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.270] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.270] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.270] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.270] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.270] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.270] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.270] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0086.270] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.270] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0086.270] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.270] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.270] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.270] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.271] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.271] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.271] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0086.271] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0086.271] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0086.271] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0086.271] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.271] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.271] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.271] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.271] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.271] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.271] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.271] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.271] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.271] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.271] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.271] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0086.271] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0086.271] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0086.271] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.271] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0086.271] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.271] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0086.271] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0086.271] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0086.271] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0086.271] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0086.271] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.271] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0086.271] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e188, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0086.272] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0086.272] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0086.272] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.272] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.272] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.272] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.272] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x301f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x301f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x2022e, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.272] GetClassNameW (in: hWnd=0x2022e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.272] GetWindowTextW (in: hWnd=0x30200, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x30200, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.272] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.272] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.273] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.273] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.274] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.274] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.274] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.274] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.274] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.274] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.274] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.274] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.274] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.274] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.274] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.274] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.274] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.274] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.274] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.274] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.274] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.274] PeekMessageW (in: lpMsg=0x90efb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90efb4) returned 0 [0086.274] CharUpperBuffW (in: lpsz="SHRDUDUXIBSFRSOHBKUB", cchLength=0x14 | out: lpsz="SHRDUDUXIBSFRSOHBKUB") returned 0x14 [0086.287] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.292] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.298] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.301] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.303] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.304] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.306] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.307] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.308] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.316] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.317] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.318] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.324] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.324] CharUpperBuffW (in: lpsz="YPVWVILATENQPHHKEPHT", cchLength=0x14 | out: lpsz="YPVWVILATENQPHHKEPHT") returned 0x14 [0086.325] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.326] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.326] CharUpperBuffW (in: lpsz="GPBLKVUOPSITYTGEOEWR", cchLength=0x14 | out: lpsz="GPBLKVUOPSITYTGEOEWR") returned 0x14 [0086.345] PeekMessageW (in: lpMsg=0x90ea9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea9c) returned 0 [0086.348] PeekMessageW (in: lpMsg=0x90ea9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea9c) returned 0 [0086.353] PeekMessageW (in: lpMsg=0x90ea9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea9c) returned 0 [0086.357] PeekMessageW (in: lpMsg=0x90ea9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea9c) returned 0 [0086.364] PeekMessageW (in: lpMsg=0x90efb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90efb4) returned 0 [0086.369] CharUpperBuffW (in: lpsz="XIPRDMOUHM_SC_XVNZUP", cchLength=0x14 | out: lpsz="XIPRDMOUHM_SC_XVNZUP") returned 0x14 [0086.387] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.387] CharUpperBuffW (in: lpsz="OXVZEGLHKYKLXNTCCQTR", cchLength=0x14 | out: lpsz="OXVZEGLHKYKLXNTCCQTR") returned 0x14 [0086.403] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.403] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.404] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.406] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.407] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.409] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.411] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.412] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.413] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.419] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.425] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.428] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.429] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.430] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.431] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.434] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.434] CharUpperBuffW (in: lpsz="GBJ_DQSWHJJWDUBFYXFM", cchLength=0x14 | out: lpsz="GBJ_DQSWHJJWDUBFYXFM") returned 0x14 [0086.435] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.447] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.447] CharUpperBuffW (in: lpsz="YSFEKSHBWYKZXZYPGXNE", cchLength=0x14 | out: lpsz="YSFEKSHBWYKZXZYPGXNE") returned 0x14 [0086.450] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.451] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.453] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.456] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.460] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.460] CharUpperBuffW (in: lpsz="ETZBKDOWNNIQP_ITLSAP", cchLength=0x14 | out: lpsz="ETZBKDOWNNIQP_ITLSAP") returned 0x14 [0086.472] PeekMessageW (in: lpMsg=0x90ea9c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea9c) returned 0 [0086.472] CharUpperBuffW (in: lpsz="IABFGAPKIGYAYSJNNSGO", cchLength=0x14 | out: lpsz="IABFGAPKIGYAYSJNNSGO") returned 0x14 [0086.473] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.481] CharUpperBuffW (in: lpsz="JLAZCEZFXQDDOTTRW_FD", cchLength=0x14 | out: lpsz="JLAZCEZFXQDDOTTRW_FD") returned 0x14 [0086.481] CharUpperBuffW (in: lpsz="RKIBCUCBZOMNBTIBKLSI", cchLength=0x14 | out: lpsz="RKIBCUCBZOMNBTIBKLSI") returned 0x14 [0086.508] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0086.508] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0086.508] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.508] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.508] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.508] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start") returned 5 [0086.509] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0086.509] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0086.509] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0086.509] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0086.509] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0086.509] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0086.509] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.509] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.509] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0086.509] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e188, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0086.510] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0086.510] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0086.510] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0086.510] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0086.510] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0086.510] GetWindowTextW (in: hWnd=0x20286, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x20286, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.510] GetWindowTextW (in: hWnd=0x2022c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x2022c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.510] GetWindowTextW (in: hWnd=0x301b8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x301b8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.510] GetWindowTextW (in: hWnd=0x3019a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x3019a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.510] GetWindowTextW (in: hWnd=0x20228, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x20228, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.510] GetWindowTextW (in: hWnd=0x20238, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x20238, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.510] GetWindowTextW (in: hWnd=0x20234, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x20234, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.510] GetWindowTextW (in: hWnd=0x20220, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x20220, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.510] GetWindowTextW (in: hWnd=0x2025c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x2025c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.510] GetWindowTextW (in: hWnd=0x20266, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x20266, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.510] GetWindowTextW (in: hWnd=0x20268, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x20268, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.510] GetWindowTextW (in: hWnd=0x20246, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.510] GetClassNameW (in: hWnd=0x20246, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.511] GetWindowTextW (in: hWnd=0x20254, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.511] GetClassNameW (in: hWnd=0x20254, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.511] GetWindowTextW (in: hWnd=0x20250, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.511] GetClassNameW (in: hWnd=0x20250, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.511] GetWindowTextW (in: hWnd=0x2024a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.511] GetClassNameW (in: hWnd=0x2024a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.511] GetWindowTextW (in: hWnd=0x2024c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.511] GetClassNameW (in: hWnd=0x2024c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.511] GetWindowTextW (in: hWnd=0x2021e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.511] GetClassNameW (in: hWnd=0x2021e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.511] GetWindowTextW (in: hWnd=0x2020e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.511] GetClassNameW (in: hWnd=0x2020e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.511] GetWindowTextW (in: hWnd=0x20216, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.511] GetClassNameW (in: hWnd=0x20216, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.511] GetWindowTextW (in: hWnd=0x201f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0086.511] GetClassNameW (in: hWnd=0x201f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0086.511] GetWindowTextW (in: hWnd=0x30130, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.511] GetClassNameW (in: hWnd=0x30130, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.511] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0086.511] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e188) returned 0x9 [0086.511] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0086.511] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.511] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.511] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e188, nMaxCount=1024 | out: lpString="C") returned 1 [0086.511] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0086.511] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.511] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0086.511] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0086.511] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0086.511] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0086.511] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0086.512] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.512] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.512] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.512] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0086.512] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.512] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0086.512] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.512] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0086.512] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e188, nMaxCount=1024 | out: lpString="Oil") returned 3 [0086.512] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0086.512] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e188, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0086.512] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0086.512] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e188, nMaxCount=1024 | out: lpString="Runner") returned 6 [0086.513] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0086.513] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0086.513] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0086.513] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0086.513] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0086.513] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0086.513] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0086.513] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e188, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0086.513] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0086.513] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e188, nMaxCount=1024 | out: lpString="Charging") returned 8 [0086.513] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0086.513] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0086.513] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0086.513] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0086.513] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0086.513] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e188, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0086.513] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0086.513] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e188, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0086.513] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0086.513] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0086.513] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0086.513] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0086.513] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0086.513] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0086.513] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0086.513] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e188, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0086.513] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0086.513] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e188, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0086.513] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0086.513] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e188, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0086.513] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0086.514] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0086.514] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0086.514] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0086.514] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0086.514] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e188, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0086.514] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0086.514] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.514] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.514] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.514] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0086.514] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0086.514] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0086.514] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e188, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0086.514] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0086.514] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e188, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0086.514] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0086.514] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e188, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0086.514] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0086.514] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.514] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0086.514] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0086.514] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0086.514] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.514] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0086.514] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0086.514] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0086.514] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.514] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.514] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.514] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.514] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.514] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.515] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.515] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0086.515] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0086.515] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.515] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.515] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.515] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0086.515] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0086.515] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0086.515] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0086.515] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.515] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.515] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.515] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.515] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.515] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.515] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0086.515] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0086.515] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0086.516] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.516] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0086.516] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.516] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0086.516] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0086.516] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0086.516] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0086.516] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0086.516] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.516] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0086.516] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e188, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0086.516] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0086.516] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0086.516] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0086.516] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.516] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.516] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.516] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.516] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.516] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.516] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.516] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.516] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.516] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.516] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.516] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.516] GetWindowTextW (in: hWnd=0x301f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.516] GetClassNameW (in: hWnd=0x301f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.516] GetWindowTextW (in: hWnd=0x2022e, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.516] GetClassNameW (in: hWnd=0x2022e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.516] GetWindowTextW (in: hWnd=0x30200, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.516] GetClassNameW (in: hWnd=0x30200, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.517] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.517] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e188, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0086.518] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0086.518] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0086.518] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0086.518] CharUpperBuffW (in: lpsz="BKJKCOXXKWHEFNRWBBRK", cchLength=0x14 | out: lpsz="BKJKCOXXKWHEFNRWBBRK") returned 0x14 [0086.519] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0086.520] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0086.520] CharUpperBuffW (in: lpsz="WIUI_WEJIDUCUGDVHKQW", cchLength=0x14 | out: lpsz="WIUI_WEJIDUCUGDVHKQW") returned 0x14 [0086.528] PeekMessageW (in: lpMsg=0x90ea84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ea84) returned 0 [0086.528] CharUpperBuffW (in: lpsz="KARJACPAECPDTTPFRITR", cchLength=0x14 | out: lpsz="KARJACPAECPDTTPFRITR") returned 0x14 [0086.528] CharUpperBuffW (in: lpsz="AHCST_PVOHK_NBFBVFFJ", cchLength=0x14 | out: lpsz="AHCST_PVOHK_NBFBVFFJ") returned 0x14 [0086.529] CharUpperBuffW (in: lpsz="MZWGUINPW_AS_MAVHDTB", cchLength=0x14 | out: lpsz="MZWGUINPW_AS_MAVHDTB") returned 0x14 [0086.529] CharUpperBuffW (in: lpsz="YFLZHVQNZTOARSPNBOFD", cchLength=0x14 | out: lpsz="YFLZHVQNZTOARSPNBOFD") returned 0x14 [0086.529] CharUpperBuffW (in: lpsz="OGKZNPRKYKEAAOZKBUUS", cchLength=0x14 | out: lpsz="OGKZNPRKYKEAAOZKBUUS") returned 0x14 [0086.529] CharUpperBuffW (in: lpsz="DUP_FCAWEY_VJYEQHHMT", cchLength=0x14 | out: lpsz="DUP_FCAWEY_VJYEQHHMT") returned 0x14 [0086.530] CharUpperBuffW (in: lpsz="JCJQSMIJAJPBGUHLMBGO", cchLength=0x14 | out: lpsz="JCJQSMIJAJPBGUHLMBGO") returned 0x14 [0086.530] CharUpperBuffW (in: lpsz="UZ_QZNKDBELYDMIOIPLA", cchLength=0x14 | out: lpsz="UZ_QZNKDBELYDMIOIPLA") returned 0x14 [0086.530] CharUpperBuffW (in: lpsz="OSBHKLTIXGKACFZVWZPF", cchLength=0x14 | out: lpsz="OSBHKLTIXGKACFZVWZPF") returned 0x14 [0086.530] CharUpperBuffW (in: lpsz="UMRHSSUTENEKFSEYFKUZ", cchLength=0x14 | out: lpsz="UMRHSSUTENEKFSEYFKUZ") returned 0x14 [0086.530] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) [0086.531] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.531] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.531] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.531] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.531] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.531] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.531] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.531] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start") returned 5 [0086.531] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0086.531] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0086.531] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0086.531] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0086.531] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e188, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0086.531] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0086.531] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.531] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.531] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.531] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.531] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.532] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.532] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0086.532] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e188, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0086.532] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0086.532] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0086.532] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0086.532] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0086.532] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0086.532] GetWindowTextW (in: hWnd=0x20286, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x20286, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.532] GetWindowTextW (in: hWnd=0x2022c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x2022c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.532] GetWindowTextW (in: hWnd=0x301b8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x301b8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.532] GetWindowTextW (in: hWnd=0x3019a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x3019a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.532] GetWindowTextW (in: hWnd=0x20228, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x20228, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.532] GetWindowTextW (in: hWnd=0x20238, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x20238, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.532] GetWindowTextW (in: hWnd=0x20234, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x20234, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.532] GetWindowTextW (in: hWnd=0x20220, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x20220, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.532] GetWindowTextW (in: hWnd=0x2025c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x2025c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.532] GetWindowTextW (in: hWnd=0x20266, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.532] GetClassNameW (in: hWnd=0x20266, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.533] GetWindowTextW (in: hWnd=0x20268, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x20268, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.533] GetWindowTextW (in: hWnd=0x20246, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x20246, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.533] GetWindowTextW (in: hWnd=0x20254, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x20254, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.533] GetWindowTextW (in: hWnd=0x20250, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x20250, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.533] GetWindowTextW (in: hWnd=0x2024a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x2024a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.533] GetWindowTextW (in: hWnd=0x2024c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x2024c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.533] GetWindowTextW (in: hWnd=0x2021e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x2021e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.533] GetWindowTextW (in: hWnd=0x2020e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x2020e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.533] GetWindowTextW (in: hWnd=0x20216, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x20216, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.533] GetWindowTextW (in: hWnd=0x201f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0086.533] GetClassNameW (in: hWnd=0x201f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0086.533] GetWindowTextW (in: hWnd=0x30130, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.533] GetClassNameW (in: hWnd=0x30130, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.533] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0086.533] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e188) returned 0x9 [0086.533] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0086.533] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.533] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e188, nMaxCount=1024 | out: lpString="C") returned 1 [0086.533] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0086.533] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.533] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0086.534] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0086.534] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0086.534] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0086.534] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0086.534] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.534] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.534] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.534] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0086.534] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.534] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0086.534] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.534] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0086.534] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e188, nMaxCount=1024 | out: lpString="Oil") returned 3 [0086.534] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0086.534] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e188, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0086.534] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0086.534] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e188, nMaxCount=1024 | out: lpString="Runner") returned 6 [0086.534] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0086.534] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0086.534] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0086.534] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0086.534] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0086.534] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e188, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0086.534] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0086.534] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e188, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0086.534] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0086.534] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e188, nMaxCount=1024 | out: lpString="Charging") returned 8 [0086.534] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0086.534] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0086.534] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0086.534] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0086.534] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0086.535] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e188, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0086.535] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0086.535] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e188, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0086.535] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0086.535] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0086.535] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0086.535] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0086.535] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0086.535] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e188, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0086.535] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0086.535] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e188, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0086.535] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0086.535] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e188, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0086.535] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0086.535] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e188, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0086.535] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0086.535] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e188, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0086.535] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0086.535] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e188, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0086.535] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0086.535] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e188, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0086.535] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0086.535] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e188, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0086.535] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.535] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.535] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0086.535] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e188, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0086.535] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0086.535] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e188, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0086.535] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0086.535] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e188, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0086.535] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0086.536] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e188, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0086.536] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0086.536] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0086.536] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e188, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0086.536] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0086.536] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0086.536] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e188, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0086.536] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0086.536] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.536] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.536] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.536] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.536] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0086.536] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0086.536] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.536] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.536] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.536] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.536] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e188, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0086.536] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0086.536] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e188, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0086.537] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0086.537] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.537] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.537] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.537] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.537] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.537] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.537] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.537] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0086.537] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.537] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0086.537] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.537] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0086.537] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e188, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0086.537] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0086.537] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e188, nMaxCount=1024 | out: lpString="") returned 0 [0086.537] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e188, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0086.537] CharUpperBuffW (in: lpsz="ZGXUPUIZPBYFEX_OMLLC", cchLength=0x14 | out: lpsz="ZGXUPUIZPBYFEX_OMLLC") returned 0x14 [0086.538] CharUpperBuffW (in: lpsz="HUEISAMF_ZWTUHSQJBFN", cchLength=0x14 | out: lpsz="HUEISAMF_ZWTUHSQJBFN") returned 0x14 [0086.538] CharUpperBuffW (in: lpsz="ZCWEUVXIBVAJQJZMJZZQ", cchLength=0x14 | out: lpsz="ZCWEUVXIBVAJQJZMJZZQ") returned 0x14 [0086.538] CharUpperBuffW (in: lpsz="DVIMDUOAMHDFTGXCLPVA", cchLength=0x14 | out: lpsz="DVIMDUOAMHDFTGXCLPVA") returned 0x14 [0086.539] CharUpperBuffW (in: lpsz="HUCQSWAQTSUPHOBKLUWV", cchLength=0x14 | out: lpsz="HUCQSWAQTSUPHOBKLUWV") returned 0x14 [0086.539] CharUpperBuffW (in: lpsz="HELUZXGAV_JUKHQAOJKM", cchLength=0x14 | out: lpsz="HELUZXGAV_JUKHQAOJKM") returned 0x14 [0086.539] CharUpperBuffW (in: lpsz="AMWEINAPQYGATAKRITRM", cchLength=0x14 | out: lpsz="AMWEINAPQYGATAKRITRM") returned 0x14 [0086.539] CharUpperBuffW (in: lpsz="IEJDCHQFCJSAGXLV_PTN", cchLength=0x14 | out: lpsz="IEJDCHQFCJSAGXLV_PTN") returned 0x14 [0086.540] CharUpperBuffW (in: lpsz="ZXODVXSGZRKUMIELIBGL", cchLength=0x14 | out: lpsz="ZXODVXSGZRKUMIELIBGL") returned 0x14 [0086.540] CharUpperBuffW (in: lpsz="CDFXWOLEVSHTZJTQSWYK", cchLength=0x14 | out: lpsz="CDFXWOLEVSHTZJTQSWYK") returned 0x14 [0086.540] CharUpperBuffW (in: lpsz="NUCYQ_YDXJYWOFNYEHKJ", cchLength=0x14 | out: lpsz="NUCYQ_YDXJYWOFNYEHKJ") returned 0x14 [0086.540] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0086.540] CharUpperBuffW (in: lpsz="ZAYJTXRGCISVJCJEUYAI", cchLength=0x14 | out: lpsz="ZAYJTXRGCISVJCJEUYAI") returned 0x14 [0086.540] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0086.541] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0086.541] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0086.541] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0086.541] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0086.541] CharUpperBuffW (in: lpsz="FZNWLIAZAPPZCTQKCFPU", cchLength=0x14 | out: lpsz="FZNWLIAZAPPZCTQKCFPU") returned 0x14 [0086.541] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0086.541] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0086.541] LoadLibraryW (lpLibFileName="kernel32") returned 0x777b0000 [0086.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAlloc", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAlloc", cchWideChar=13, lpMultiByteStr=0xd38750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAlloc", lpUsedDefaultChar=0x0) returned 13 [0086.542] GetProcAddress (hModule=0x777b0000, lpProcName="VirtualAlloc") returned 0x77802fb6 [0086.542] VirtualAlloc (lpAddress=0x0, dwSize=0x5c2, flAllocationType=0x3000, flProtect=0x40) returned 0x1c00000 [0086.542] FreeLibrary (hLibModule=0x777b0000) returned 1 [0086.542] CharUpperBuffW (in: lpsz="KSQMASHHFN_IRADDJQDU", cchLength=0x14 | out: lpsz="KSQMASHHFN_IRADDJQDU") returned 0x14 [0086.543] CharUpperBuffW (in: lpsz="SVDTQVHBUIKVSFLUSCUF", cchLength=0x14 | out: lpsz="SVDTQVHBUIKVSFLUSCUF") returned 0x14 [0086.543] CharUpperBuffW (in: lpsz="UQMYJOLQDZOAUWARYDXA", cchLength=0x14 | out: lpsz="UQMYJOLQDZOAUWARYDXA") returned 0x14 [0086.544] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0086.642] CharUpperBuffW (in: lpsz="PPEDUMGVDWAPHAMAVXZD", cchLength=0x14 | out: lpsz="PPEDUMGVDWAPHAMAVXZD") returned 0x14 [0086.696] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0086.710] PeekMessageW (in: lpMsg=0x90efb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90efb4) returned 0 [0086.710] CharUpperBuffW (in: lpsz="FCLRBMLUDIKKGG_YXYYF", cchLength=0x14 | out: lpsz="FCLRBMLUDIKKGG_YXYYF") returned 0x14 [0086.710] CharUpperBuffW (in: lpsz="YAWQLVHMT_FNIKUBZFUB", cchLength=0x14 | out: lpsz="YAWQLVHMT_FNIKUBZFUB") returned 0x14 [0086.721] PeekMessageW (in: lpMsg=0x90efb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90efb4) returned 0 [0086.721] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0086.721] CharUpperBuffW (in: lpsz="WMVLSELKWJVXCQYCFLEX", cchLength=0x14 | out: lpsz="WMVLSELKWJVXCQYCFLEX") returned 0x14 [0086.722] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0086.722] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0086.722] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0086.724] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x90e550*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x90e64c | out: lpCommandLine="", lpProcessInformation=0x90e64c*(hProcess=0x258, hThread=0x230, dwProcessId=0x24c, dwThreadId=0x2c8)) returned 1 [0086.731] GetThreadContext (in: hThread=0x230, lpContext=0x90e284 | out: lpContext=0x90e284*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x3b, SegEs=0x23, SegDs=0x23, Edi=0x0, Esi=0x0, Ebx=0x7ffdb000, Edx=0x0, Ecx=0x0, Eax=0xf7b7de, Ebp=0x0, Eip=0x77927098, SegCs=0x1b, EFlags=0x200, Esp=0x2ff980, SegSs=0x23, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0086.732] ReadProcessMemory (in: hProcess=0x258, lpBaseAddress=0x7ffdb008, lpBuffer=0x90e630, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x90e630*, lpNumberOfBytesRead=0x0) returned 1 [0086.732] VirtualAlloc (lpAddress=0x0, dwSize=0x56000, flAllocationType=0x3000, flProtect=0x40) returned 0x23e0000 [0086.732] VirtualAllocEx (hProcess=0x258, lpAddress=0x400000, dwSize=0x56000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0086.739] WriteProcessMemory (in: hProcess=0x258, lpBaseAddress=0x400000, lpBuffer=0x23e0000*, nSize=0x56000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x23e0000*, lpNumberOfBytesWritten=0x0) returned 1 [0086.748] VirtualProtectEx (in: hProcess=0x258, lpAddress=0x400000, dwSize=0x200, flNewProtect=0x2, lpflOldProtect=0x90e610 | out: lpflOldProtect=0x90e610*=0x40) returned 1 [0086.748] VirtualProtectEx (in: hProcess=0x258, lpAddress=0x402000, dwSize=0x4fd24, flNewProtect=0x20, lpflOldProtect=0x90e610 | out: lpflOldProtect=0x90e610*=0x40) returned 1 [0086.749] VirtualProtectEx (in: hProcess=0x258, lpAddress=0x452000, dwSize=0x2d0, flNewProtect=0x2, lpflOldProtect=0x90e610 | out: lpflOldProtect=0x90e610*=0x40) returned 1 [0086.749] VirtualProtectEx (in: hProcess=0x258, lpAddress=0x454000, dwSize=0xc, flNewProtect=0x2, lpflOldProtect=0x90e610 | out: lpflOldProtect=0x90e610*=0x40) returned 1 [0086.749] VirtualFree (lpAddress=0x23e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.751] WriteProcessMemory (in: hProcess=0x258, lpBaseAddress=0x7ffdb008, lpBuffer=0x90e66c*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x90e66c*, lpNumberOfBytesWritten=0x0) returned 1 [0086.752] SetThreadContext (hThread=0x230, lpContext=0x90e284*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x3b, SegEs=0x23, SegDs=0x23, Edi=0x0, Esi=0x0, Ebx=0x7ffdb000, Edx=0x0, Ecx=0x0, Eax=0x451d1e, Ebp=0x0, Eip=0x77927098, SegCs=0x1b, EFlags=0x200, Esp=0x2ff980, SegSs=0x23, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0086.752] ResumeThread (hThread=0x230) returned 0x1 [0086.793] CharUpperBuffW (in: lpsz="RXTMHSDEUWWTMBCYVFVU", cchLength=0x14 | out: lpsz="RXTMHSDEUWWTMBCYVFVU") returned 0x14 [0086.805] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0086.805] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0086.806] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0086.806] CharUpperBuffW (in: lpsz="NDPUETVCWXC_GCLTORPI", cchLength=0x14 | out: lpsz="NDPUETVCWXC_GCLTORPI") returned 0x14 [0086.806] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0086.810] PeekMessageW (in: lpMsg=0x90e74c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e74c) returned 0 [0086.810] CharUpperBuffW (in: lpsz="JXIUTGRKIECTYETFFUVY", cchLength=0x14 | out: lpsz="JXIUTGRKIECTYETFFUVY") returned 0x14 [0086.812] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0086.812] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0086.813] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0086.813] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0086.813] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0086.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OpenProcess", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OpenProcess", cchWideChar=12, lpMultiByteStr=0xd39158, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OpenProcess", lpUsedDefaultChar=0x0) returned 12 [0086.813] GetProcAddress (hModule=0x777b0000, lpProcName="OpenProcess") returned 0x777f59d7 [0086.813] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x24c) returned 0x234 [0086.813] FreeLibrary (hLibModule=0x777b0000) returned 1 [0086.813] CharUpperBuffW (in: lpsz="MFYVECQHVOGYZWFUNTDZ", cchLength=0x14 | out: lpsz="MFYVECQHVOGYZWFUNTDZ") returned 0x14 [0086.852] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0086.855] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0086.856] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0086.874] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0087.087] PeekMessageW (in: lpMsg=0x90e6fc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e6fc) returned 0 [0087.088] CharUpperBuffW (in: lpsz="NUCYQ_YDXJYWOFNYEHKJ", cchLength=0x14 | out: lpsz="NUCYQ_YDXJYWOFNYEHKJ") returned 0x14 [0087.088] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0087.088] CharUpperBuffW (in: lpsz="OLKNRFYRRXZISMVGNLHE", cchLength=0x14 | out: lpsz="OLKNRFYRRXZISMVGNLHE") returned 0x14 [0087.088] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0087.089] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0087.091] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0087.091] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0087.091] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0087.092] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0087.092] CharUpperBuffW (in: lpsz="WTLHCJPNMSGZFENQCDYX", cchLength=0x14 | out: lpsz="WTLHCJPNMSGZFENQCDYX") returned 0x14 [0087.092] LoadLibraryW (lpLibFileName="kernel32") returned 0x777b0000 [0087.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0087.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=12, lpMultiByteStr=0xd39338, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualFree", lpUsedDefaultChar=0x0) returned 12 [0087.092] GetProcAddress (hModule=0x777b0000, lpProcName="VirtualFree") returned 0x77801da4 [0087.093] FreeLibrary (hLibModule=0x777b0000) returned 1 [0087.093] CharUpperBuffW (in: lpsz="NUCYQ_YDXJYWOFNYEHKJ", cchLength=0x14 | out: lpsz="NUCYQ_YDXJYWOFNYEHKJ") returned 0x14 [0087.093] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0087.093] CharUpperBuffW (in: lpsz="OLKNRFYRRXZISMVGNLHE", cchLength=0x14 | out: lpsz="OLKNRFYRRXZISMVGNLHE") returned 0x14 [0087.094] PeekMessageW (in: lpMsg=0x90e734, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90e734) returned 0 [0087.094] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0087.094] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0087.094] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0087.095] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0087.095] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0087.095] CharUpperBuffW (in: lpsz="WTLHCJPNMSGZFENQCDYX", cchLength=0x14 | out: lpsz="WTLHCJPNMSGZFENQCDYX") returned 0x14 [0087.095] LoadLibraryW (lpLibFileName="kernel32") returned 0x777b0000 [0087.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0087.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=12, lpMultiByteStr=0xd39230, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualFree", lpUsedDefaultChar=0x0) returned 12 [0087.096] GetProcAddress (hModule=0x777b0000, lpProcName="VirtualFree") returned 0x77801da4 [0087.096] FreeLibrary (hLibModule=0x777b0000) returned 1 [0087.108] timeGetTime () returned 0xa6e810 [0087.108] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.108] Sleep (dwMilliseconds=0xa) [0087.134] timeGetTime () returned 0xa6e81f [0087.134] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.134] Sleep (dwMilliseconds=0xa) [0087.137] timeGetTime () returned 0xa6e82f [0087.137] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 1 [0087.137] TranslateMessage (lpMsg=0x90f554) returned 0 [0087.137] DispatchMessageW (lpMsg=0x90f554) returned 0x0 [0087.137] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0087.137] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0087.137] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.137] Sleep (dwMilliseconds=0xa) [0087.153] timeGetTime () returned 0xa6e83e [0087.153] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.153] Sleep (dwMilliseconds=0xa) [0087.168] timeGetTime () returned 0xa6e84e [0087.168] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.168] Sleep (dwMilliseconds=0xa) [0087.183] timeGetTime () returned 0xa6e85e [0087.184] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.184] Sleep (dwMilliseconds=0xa) [0087.204] timeGetTime () returned 0xa6e86d [0087.204] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.204] Sleep (dwMilliseconds=0xa) [0087.214] timeGetTime () returned 0xa6e87d [0087.214] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.214] Sleep (dwMilliseconds=0xa) [0087.233] timeGetTime () returned 0xa6e88c [0087.233] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.233] Sleep (dwMilliseconds=0xa) [0087.257] timeGetTime () returned 0xa6e89c [0087.257] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.257] Sleep (dwMilliseconds=0xa) [0087.282] timeGetTime () returned 0xa6e8bb [0087.282] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.282] Sleep (dwMilliseconds=0xa) [0087.297] timeGetTime () returned 0xa6e8cb [0087.297] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.297] Sleep (dwMilliseconds=0xa) [0087.312] timeGetTime () returned 0xa6e8da [0087.312] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.312] Sleep (dwMilliseconds=0xa) [0087.340] timeGetTime () returned 0xa6e8fa [0087.340] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.340] Sleep (dwMilliseconds=0xa) [0087.359] timeGetTime () returned 0xa6e909 [0087.359] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.359] Sleep (dwMilliseconds=0xa) [0087.371] timeGetTime () returned 0xa6e919 [0087.371] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.371] Sleep (dwMilliseconds=0xa) [0087.386] timeGetTime () returned 0xa6e928 [0087.386] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.386] Sleep (dwMilliseconds=0xa) [0087.433] timeGetTime () returned 0xa6e957 [0087.433] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.433] Sleep (dwMilliseconds=0xa) [0087.459] timeGetTime () returned 0xa6e967 [0087.459] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.459] Sleep (dwMilliseconds=0xa) [0087.464] timeGetTime () returned 0xa6e976 [0087.464] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.464] Sleep (dwMilliseconds=0xa) [0087.479] timeGetTime () returned 0xa6e986 [0087.479] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.480] Sleep (dwMilliseconds=0xa) [0087.495] timeGetTime () returned 0xa6e996 [0087.495] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.495] Sleep (dwMilliseconds=0xa) [0087.521] timeGetTime () returned 0xa6e9a5 [0087.521] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.521] Sleep (dwMilliseconds=0xa) [0087.528] timeGetTime () returned 0xa6e9b5 [0087.528] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.528] Sleep (dwMilliseconds=0xa) [0087.542] timeGetTime () returned 0xa6e9c4 [0087.542] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.542] Sleep (dwMilliseconds=0xa) [0087.564] timeGetTime () returned 0xa6e9d4 [0087.564] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.564] Sleep (dwMilliseconds=0xa) [0087.573] timeGetTime () returned 0xa6e9e4 [0087.573] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.573] Sleep (dwMilliseconds=0xa) [0087.592] timeGetTime () returned 0xa6e9f3 [0087.592] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.592] Sleep (dwMilliseconds=0xa) [0087.604] timeGetTime () returned 0xa6ea03 [0087.604] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.605] Sleep (dwMilliseconds=0xa) [0087.622] timeGetTime () returned 0xa6ea12 [0087.622] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.622] Sleep (dwMilliseconds=0xa) [0087.637] timeGetTime () returned 0xa6ea22 [0087.637] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.637] Sleep (dwMilliseconds=0xa) [0087.652] timeGetTime () returned 0xa6ea32 [0087.652] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.652] Sleep (dwMilliseconds=0xa) [0087.672] timeGetTime () returned 0xa6ea41 [0087.672] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.672] Sleep (dwMilliseconds=0xa) [0087.682] timeGetTime () returned 0xa6ea51 [0087.682] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.682] Sleep (dwMilliseconds=0xa) [0087.698] timeGetTime () returned 0xa6ea60 [0087.698] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.698] Sleep (dwMilliseconds=0xa) [0087.714] timeGetTime () returned 0xa6ea70 [0087.714] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.714] Sleep (dwMilliseconds=0xa) [0087.731] timeGetTime () returned 0xa6ea80 [0087.731] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.731] Sleep (dwMilliseconds=0xa) [0087.745] timeGetTime () returned 0xa6ea8f [0087.745] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.745] Sleep (dwMilliseconds=0xa) [0087.766] timeGetTime () returned 0xa6ea9f [0087.766] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.766] Sleep (dwMilliseconds=0xa) [0087.779] timeGetTime () returned 0xa6eaae [0087.779] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.779] Sleep (dwMilliseconds=0xa) [0087.800] timeGetTime () returned 0xa6eabe [0087.800] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.800] Sleep (dwMilliseconds=0xa) [0087.816] timeGetTime () returned 0xa6eace [0087.816] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.816] Sleep (dwMilliseconds=0xa) [0087.824] timeGetTime () returned 0xa6eadd [0087.824] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.824] Sleep (dwMilliseconds=0xa) [0087.843] timeGetTime () returned 0xa6eaed [0087.843] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.843] Sleep (dwMilliseconds=0xa) [0087.854] timeGetTime () returned 0xa6eafc [0087.854] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.854] Sleep (dwMilliseconds=0xa) [0087.901] timeGetTime () returned 0xa6eb2b [0087.901] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 1 [0087.901] TranslateMessage (lpMsg=0x90f554) returned 0 [0087.901] DispatchMessageW (lpMsg=0x90f554) returned 0x0 [0087.901] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0087.901] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0087.901] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.901] Sleep (dwMilliseconds=0xa) [0087.936] timeGetTime () returned 0xa6eb4a [0087.936] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.936] Sleep (dwMilliseconds=0xa) [0087.949] timeGetTime () returned 0xa6eb5a [0087.949] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.949] Sleep (dwMilliseconds=0xa) [0087.965] timeGetTime () returned 0xa6eb6a [0087.965] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.965] Sleep (dwMilliseconds=0xa) [0087.984] timeGetTime () returned 0xa6eb79 [0087.985] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.985] Sleep (dwMilliseconds=0xa) [0087.998] timeGetTime () returned 0xa6eb89 [0087.998] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0087.998] Sleep (dwMilliseconds=0xa) [0088.010] timeGetTime () returned 0xa6eb98 [0088.010] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.010] Sleep (dwMilliseconds=0xa) [0088.038] timeGetTime () returned 0xa6eba8 [0088.038] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.038] Sleep (dwMilliseconds=0xa) [0088.049] timeGetTime () returned 0xa6ebb8 [0088.049] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.049] Sleep (dwMilliseconds=0xa) [0088.069] timeGetTime () returned 0xa6ebc7 [0088.069] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.069] Sleep (dwMilliseconds=0xa) [0088.088] timeGetTime () returned 0xa6ebe6 [0088.088] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.088] Sleep (dwMilliseconds=0xa) [0088.105] timeGetTime () returned 0xa6ebf6 [0088.105] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.105] Sleep (dwMilliseconds=0xa) [0088.150] timeGetTime () returned 0xa6ec25 [0088.150] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.150] Sleep (dwMilliseconds=0xa) [0088.197] timeGetTime () returned 0xa6ec54 [0088.197] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.197] Sleep (dwMilliseconds=0xa) [0088.244] timeGetTime () returned 0xa6ec82 [0088.244] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.244] Sleep (dwMilliseconds=0xa) [0088.291] timeGetTime () returned 0xa6ecb1 [0088.291] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.291] Sleep (dwMilliseconds=0xa) [0088.334] timeGetTime () returned 0xa6ecd0 [0088.334] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.334] Sleep (dwMilliseconds=0xa) [0088.338] timeGetTime () returned 0xa6ece0 [0088.338] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.338] Sleep (dwMilliseconds=0xa) [0088.371] timeGetTime () returned 0xa6ecff [0088.371] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.371] Sleep (dwMilliseconds=0xa) [0088.385] timeGetTime () returned 0xa6ed0f [0088.385] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.385] Sleep (dwMilliseconds=0xa) [0088.409] timeGetTime () returned 0xa6ed1e [0088.409] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.409] Sleep (dwMilliseconds=0xa) [0088.431] timeGetTime () returned 0xa6ed3e [0088.432] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.432] Sleep (dwMilliseconds=0xa) [0088.476] timeGetTime () returned 0xa6ed5d [0088.476] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.476] Sleep (dwMilliseconds=0xa) [0088.478] timeGetTime () returned 0xa6ed6c [0088.478] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.478] Sleep (dwMilliseconds=0xa) [0088.507] timeGetTime () returned 0xa6ed7c [0088.507] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.507] Sleep (dwMilliseconds=0xa) [0088.511] timeGetTime () returned 0xa6ed8c [0088.511] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.511] Sleep (dwMilliseconds=0xa) [0088.525] timeGetTime () returned 0xa6ed9b [0088.525] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.525] Sleep (dwMilliseconds=0xa) [0088.543] timeGetTime () returned 0xa6edab [0088.543] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.543] Sleep (dwMilliseconds=0xa) [0088.571] timeGetTime () returned 0xa6edca [0088.572] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.572] Sleep (dwMilliseconds=0xa) [0088.604] timeGetTime () returned 0xa6ede9 [0088.604] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.604] Sleep (dwMilliseconds=0xa) [0088.619] timeGetTime () returned 0xa6edf9 [0088.619] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.619] Sleep (dwMilliseconds=0xa) [0088.634] timeGetTime () returned 0xa6ee08 [0088.634] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.634] Sleep (dwMilliseconds=0xa) [0088.649] timeGetTime () returned 0xa6ee18 [0088.649] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.650] Sleep (dwMilliseconds=0xa) [0088.666] timeGetTime () returned 0xa6ee28 [0088.666] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 1 [0088.666] TranslateMessage (lpMsg=0x90f554) returned 0 [0088.666] DispatchMessageW (lpMsg=0x90f554) returned 0x0 [0088.666] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0088.666] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0088.666] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.666] Sleep (dwMilliseconds=0xa) [0088.681] timeGetTime () returned 0xa6ee37 [0088.681] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.681] Sleep (dwMilliseconds=0xa) [0088.696] timeGetTime () returned 0xa6ee47 [0088.696] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.696] Sleep (dwMilliseconds=0xa) [0088.712] timeGetTime () returned 0xa6ee56 [0088.712] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.712] Sleep (dwMilliseconds=0xa) [0088.728] timeGetTime () returned 0xa6ee66 [0088.728] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.728] Sleep (dwMilliseconds=0xa) [0088.752] timeGetTime () returned 0xa6ee76 [0088.753] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.753] Sleep (dwMilliseconds=0xa) [0088.759] timeGetTime () returned 0xa6ee85 [0088.760] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.769] Sleep (dwMilliseconds=0xa) [0088.785] timeGetTime () returned 0xa6ee95 [0088.785] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.785] Sleep (dwMilliseconds=0xa) [0088.806] timeGetTime () returned 0xa6eeb4 [0088.806] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.806] Sleep (dwMilliseconds=0xa) [0088.853] timeGetTime () returned 0xa6eee3 [0088.853] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.853] Sleep (dwMilliseconds=0xa) [0088.903] timeGetTime () returned 0xa6ef12 [0088.903] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.903] Sleep (dwMilliseconds=0xa) [0088.946] timeGetTime () returned 0xa6ef40 [0088.947] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.947] Sleep (dwMilliseconds=0xa) [0088.991] timeGetTime () returned 0xa6ef60 [0088.991] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0088.991] Sleep (dwMilliseconds=0xa) [0089.022] timeGetTime () returned 0xa6ef7f [0089.022] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.022] Sleep (dwMilliseconds=0xa) [0089.024] timeGetTime () returned 0xa6ef8e [0089.025] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.025] Sleep (dwMilliseconds=0xa) [0089.039] timeGetTime () returned 0xa6ef9e [0089.040] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.040] Sleep (dwMilliseconds=0xa) [0089.056] timeGetTime () returned 0xa6efae [0089.056] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.056] Sleep (dwMilliseconds=0xa) [0089.087] timeGetTime () returned 0xa6efcd [0089.087] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.087] Sleep (dwMilliseconds=0xa) [0089.133] timeGetTime () returned 0xa6effc [0089.133] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.133] Sleep (dwMilliseconds=0xa) [0089.169] timeGetTime () returned 0xa6f01b [0089.169] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.169] Sleep (dwMilliseconds=0xa) [0089.180] timeGetTime () returned 0xa6f02a [0089.180] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.180] Sleep (dwMilliseconds=0xa) [0089.211] timeGetTime () returned 0xa6f04a [0089.211] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.211] Sleep (dwMilliseconds=0xa) [0089.259] timeGetTime () returned 0xa6f078 [0089.259] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.259] Sleep (dwMilliseconds=0xa) [0089.305] timeGetTime () returned 0xa6f0a7 [0089.305] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.305] Sleep (dwMilliseconds=0xa) [0089.351] timeGetTime () returned 0xa6f0d6 [0089.351] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.351] Sleep (dwMilliseconds=0xa) [0089.399] timeGetTime () returned 0xa6f105 [0089.399] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.399] Sleep (dwMilliseconds=0xa) [0089.445] timeGetTime () returned 0xa6f134 [0089.445] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 1 [0089.445] TranslateMessage (lpMsg=0x90f554) returned 0 [0089.445] DispatchMessageW (lpMsg=0x90f554) returned 0x0 [0089.445] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0089.445] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0089.445] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.445] Sleep (dwMilliseconds=0xa) [0089.495] timeGetTime () returned 0xa6f162 [0089.495] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.495] Sleep (dwMilliseconds=0xa) [0089.539] timeGetTime () returned 0xa6f191 [0089.539] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.539] Sleep (dwMilliseconds=0xa) [0089.586] timeGetTime () returned 0xa6f1c0 [0089.586] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.586] Sleep (dwMilliseconds=0xa) [0089.632] timeGetTime () returned 0xa6f1ef [0089.632] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.632] Sleep (dwMilliseconds=0xa) [0089.679] timeGetTime () returned 0xa6f21e [0089.679] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.679] Sleep (dwMilliseconds=0xa) [0089.726] timeGetTime () returned 0xa6f24c [0089.726] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.726] Sleep (dwMilliseconds=0xa) [0089.773] timeGetTime () returned 0xa6f27b [0089.773] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.773] Sleep (dwMilliseconds=0xa) [0089.821] timeGetTime () returned 0xa6f2aa [0089.821] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.821] Sleep (dwMilliseconds=0xa) [0089.840] timeGetTime () returned 0xa6f2ba [0089.840] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.840] Sleep (dwMilliseconds=0xa) [0089.866] timeGetTime () returned 0xa6f2d9 [0089.866] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.866] Sleep (dwMilliseconds=0xa) [0089.892] timeGetTime () returned 0xa6f2e8 [0089.892] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.892] Sleep (dwMilliseconds=0xa) [0089.898] timeGetTime () returned 0xa6f2f8 [0089.898] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.898] Sleep (dwMilliseconds=0xa) [0089.913] timeGetTime () returned 0xa6f308 [0089.913] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.913] Sleep (dwMilliseconds=0xa) [0089.951] timeGetTime () returned 0xa6f327 [0089.951] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.951] Sleep (dwMilliseconds=0xa) [0089.991] timeGetTime () returned 0xa6f356 [0089.991] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0089.991] Sleep (dwMilliseconds=0xa) [0090.015] timeGetTime () returned 0xa6f365 [0090.015] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.015] Sleep (dwMilliseconds=0xa) [0090.032] timeGetTime () returned 0xa6f375 [0090.032] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.032] Sleep (dwMilliseconds=0xa) [0090.072] timeGetTime () returned 0xa6f3a4 [0090.072] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.072] Sleep (dwMilliseconds=0xa) [0090.132] timeGetTime () returned 0xa6f3e2 [0090.132] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.132] Sleep (dwMilliseconds=0xa) [0090.177] timeGetTime () returned 0xa6f401 [0090.177] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.177] Sleep (dwMilliseconds=0xa) [0090.201] timeGetTime () returned 0xa6f420 [0090.201] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.201] Sleep (dwMilliseconds=0xa) [0090.211] timeGetTime () returned 0xa6f430 [0090.211] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 1 [0090.211] TranslateMessage (lpMsg=0x90f554) returned 0 [0090.211] DispatchMessageW (lpMsg=0x90f554) returned 0x0 [0090.211] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0090.211] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0090.211] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.211] Sleep (dwMilliseconds=0xa) [0090.256] timeGetTime () returned 0xa6f45f [0090.256] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.256] Sleep (dwMilliseconds=0xa) [0090.277] timeGetTime () returned 0xa6f46e [0090.277] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.277] Sleep (dwMilliseconds=0xa) [0090.293] timeGetTime () returned 0xa6f47e [0090.293] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.293] Sleep (dwMilliseconds=0xa) [0090.306] timeGetTime () returned 0xa6f48e [0090.306] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.306] Sleep (dwMilliseconds=0xa) [0090.334] timeGetTime () returned 0xa6f4ad [0090.334] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.334] Sleep (dwMilliseconds=0xa) [0090.355] timeGetTime () returned 0xa6f4bc [0090.355] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.355] Sleep (dwMilliseconds=0xa) [0090.366] timeGetTime () returned 0xa6f4cc [0090.366] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.366] Sleep (dwMilliseconds=0xa) [0090.381] timeGetTime () returned 0xa6f4dc [0090.381] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.381] Sleep (dwMilliseconds=0xa) [0090.428] timeGetTime () returned 0xa6f50a [0090.428] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.428] Sleep (dwMilliseconds=0xa) [0090.452] timeGetTime () returned 0xa6f51a [0090.452] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.452] Sleep (dwMilliseconds=0xa) [0090.461] timeGetTime () returned 0xa6f52a [0090.461] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.461] Sleep (dwMilliseconds=0xa) [0090.489] timeGetTime () returned 0xa6f539 [0090.489] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.489] Sleep (dwMilliseconds=0xa) [0090.492] timeGetTime () returned 0xa6f549 [0090.492] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.492] Sleep (dwMilliseconds=0xa) [0090.506] timeGetTime () returned 0xa6f558 [0090.506] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.506] Sleep (dwMilliseconds=0xa) [0090.527] timeGetTime () returned 0xa6f568 [0090.527] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.527] Sleep (dwMilliseconds=0xa) [0090.542] timeGetTime () returned 0xa6f578 [0090.542] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.542] Sleep (dwMilliseconds=0xa) [0090.556] timeGetTime () returned 0xa6f587 [0090.556] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.556] Sleep (dwMilliseconds=0xa) [0090.576] timeGetTime () returned 0xa6f597 [0090.576] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.576] Sleep (dwMilliseconds=0xa) [0090.594] timeGetTime () returned 0xa6f5a6 [0090.594] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.594] Sleep (dwMilliseconds=0xa) [0090.601] timeGetTime () returned 0xa6f5b6 [0090.601] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.601] Sleep (dwMilliseconds=0xa) [0090.615] timeGetTime () returned 0xa6f5c6 [0090.615] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.615] Sleep (dwMilliseconds=0xa) [0090.650] timeGetTime () returned 0xa6f5e5 [0090.650] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.650] Sleep (dwMilliseconds=0xa) [0090.662] timeGetTime () returned 0xa6f5f4 [0090.662] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.662] Sleep (dwMilliseconds=0xa) [0090.678] timeGetTime () returned 0xa6f604 [0090.678] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.678] Sleep (dwMilliseconds=0xa) [0090.696] timeGetTime () returned 0xa6f614 [0090.696] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.696] Sleep (dwMilliseconds=0xa) [0090.710] timeGetTime () returned 0xa6f623 [0090.710] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.710] Sleep (dwMilliseconds=0xa) [0090.727] timeGetTime () returned 0xa6f633 [0090.727] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.727] Sleep (dwMilliseconds=0xa) [0090.756] timeGetTime () returned 0xa6f652 [0090.756] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.756] Sleep (dwMilliseconds=0xa) [0090.773] timeGetTime () returned 0xa6f662 [0090.773] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.773] Sleep (dwMilliseconds=0xa) [0090.795] timeGetTime () returned 0xa6f671 [0090.795] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.795] Sleep (dwMilliseconds=0xa) [0090.804] timeGetTime () returned 0xa6f681 [0090.804] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.804] Sleep (dwMilliseconds=0xa) [0090.833] timeGetTime () returned 0xa6f690 [0090.833] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.833] Sleep (dwMilliseconds=0xa) [0090.847] timeGetTime () returned 0xa6f6a0 [0090.847] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.847] Sleep (dwMilliseconds=0xa) [0090.877] timeGetTime () returned 0xa6f6bf [0090.877] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.877] Sleep (dwMilliseconds=0xa) [0090.881] timeGetTime () returned 0xa6f6cf [0090.881] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.881] Sleep (dwMilliseconds=0xa) [0090.916] timeGetTime () returned 0xa6f6ee [0090.916] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.916] Sleep (dwMilliseconds=0xa) [0090.927] timeGetTime () returned 0xa6f6fe [0090.927] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.927] Sleep (dwMilliseconds=0xa) [0090.943] timeGetTime () returned 0xa6f70d [0090.943] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.943] Sleep (dwMilliseconds=0xa) [0090.966] timeGetTime () returned 0xa6f71d [0090.966] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.966] Sleep (dwMilliseconds=0xa) [0090.982] timeGetTime () returned 0xa6f72c [0090.982] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 1 [0090.982] TranslateMessage (lpMsg=0x90f554) returned 0 [0090.982] DispatchMessageW (lpMsg=0x90f554) returned 0x0 [0090.982] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0090.982] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0090.982] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0090.982] Sleep (dwMilliseconds=0xa) [0091.005] timeGetTime () returned 0xa6f74c [0091.005] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.005] Sleep (dwMilliseconds=0xa) [0091.023] timeGetTime () returned 0xa6f75b [0091.023] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.023] Sleep (dwMilliseconds=0xa) [0091.036] timeGetTime () returned 0xa6f76b [0091.037] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.037] Sleep (dwMilliseconds=0xa) [0091.069] timeGetTime () returned 0xa6f78a [0091.069] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.069] Sleep (dwMilliseconds=0xa) [0091.083] timeGetTime () returned 0xa6f79a [0091.083] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.083] Sleep (dwMilliseconds=0xa) [0091.099] timeGetTime () returned 0xa6f7a9 [0091.099] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.099] Sleep (dwMilliseconds=0xa) [0091.144] timeGetTime () returned 0xa6f7c8 [0091.144] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.144] Sleep (dwMilliseconds=0xa) [0091.152] timeGetTime () returned 0xa6f7d8 [0091.152] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.152] Sleep (dwMilliseconds=0xa) [0091.164] timeGetTime () returned 0xa6f7e8 [0091.164] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.164] Sleep (dwMilliseconds=0xa) [0091.186] timeGetTime () returned 0xa6f7f7 [0091.186] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.186] Sleep (dwMilliseconds=0xa) [0091.196] timeGetTime () returned 0xa6f807 [0091.196] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.196] Sleep (dwMilliseconds=0xa) [0091.212] timeGetTime () returned 0xa6f816 [0091.212] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.212] Sleep (dwMilliseconds=0xa) [0091.224] timeGetTime () returned 0xa6f826 [0091.224] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.224] Sleep (dwMilliseconds=0xa) [0091.241] timeGetTime () returned 0xa6f836 [0091.241] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.241] Sleep (dwMilliseconds=0xa) [0091.263] timeGetTime () returned 0xa6f845 [0091.263] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.263] Sleep (dwMilliseconds=0xa) [0091.281] timeGetTime () returned 0xa6f855 [0091.281] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.281] Sleep (dwMilliseconds=0xa) [0091.294] timeGetTime () returned 0xa6f864 [0091.294] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.294] Sleep (dwMilliseconds=0xa) [0091.302] timeGetTime () returned 0xa6f874 [0091.302] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.302] Sleep (dwMilliseconds=0xa) [0091.337] timeGetTime () returned 0xa6f893 [0091.337] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.337] Sleep (dwMilliseconds=0xa) [0091.365] timeGetTime () returned 0xa6f8b2 [0091.365] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.365] Sleep (dwMilliseconds=0xa) [0091.380] timeGetTime () returned 0xa6f8c2 [0091.380] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.380] Sleep (dwMilliseconds=0xa) [0091.396] timeGetTime () returned 0xa6f8d2 [0091.396] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.397] Sleep (dwMilliseconds=0xa) [0091.412] timeGetTime () returned 0xa6f8e1 [0091.412] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.412] Sleep (dwMilliseconds=0xa) [0091.430] timeGetTime () returned 0xa6f8f1 [0091.430] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.430] Sleep (dwMilliseconds=0xa) [0091.444] timeGetTime () returned 0xa6f900 [0091.444] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.444] Sleep (dwMilliseconds=0xa) [0091.480] timeGetTime () returned 0xa6f920 [0091.480] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.480] Sleep (dwMilliseconds=0xa) [0091.499] timeGetTime () returned 0xa6f92f [0091.499] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.499] Sleep (dwMilliseconds=0xa) [0091.531] timeGetTime () returned 0xa6f94e [0091.531] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.531] Sleep (dwMilliseconds=0xa) [0091.536] timeGetTime () returned 0xa6f95e [0091.536] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.536] Sleep (dwMilliseconds=0xa) [0091.631] timeGetTime () returned 0xa6f97d [0091.631] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.631] Sleep (dwMilliseconds=0xa) [0091.674] timeGetTime () returned 0xa6f99c [0091.674] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.674] Sleep (dwMilliseconds=0xa) [0091.723] timeGetTime () returned 0xa6f9db [0091.723] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.723] Sleep (dwMilliseconds=0xa) [0091.760] timeGetTime () returned 0xa6f9fa [0091.760] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.760] Sleep (dwMilliseconds=0xa) [0091.801] timeGetTime () returned 0xa6fa29 [0091.801] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 1 [0091.801] TranslateMessage (lpMsg=0x90f554) returned 0 [0091.801] DispatchMessageW (lpMsg=0x90f554) returned 0x0 [0091.801] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0091.801] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0091.801] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.801] Sleep (dwMilliseconds=0xa) [0091.817] timeGetTime () returned 0xa6fa38 [0091.817] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.817] Sleep (dwMilliseconds=0xa) [0091.853] timeGetTime () returned 0xa6fa58 [0091.853] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.853] Sleep (dwMilliseconds=0xa) [0091.889] timeGetTime () returned 0xa6fa77 [0091.889] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.889] Sleep (dwMilliseconds=0xa) [0091.895] timeGetTime () returned 0xa6fa86 [0091.895] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0091.895] Sleep (dwMilliseconds=0xa) [0092.077] timeGetTime () returned 0xa6fa96 [0092.077] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.077] Sleep (dwMilliseconds=0xa) [0092.086] timeGetTime () returned 0xa6faa6 [0092.086] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.086] Sleep (dwMilliseconds=0xa) [0092.135] timeGetTime () returned 0xa6fad4 [0092.139] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.139] Sleep (dwMilliseconds=0xa) [0092.152] timeGetTime () returned 0xa6fae4 [0092.152] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.152] Sleep (dwMilliseconds=0xa) [0092.161] timeGetTime () returned 0xa6faf4 [0092.161] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.161] Sleep (dwMilliseconds=0xa) [0092.178] timeGetTime () returned 0xa6fb03 [0092.178] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.178] Sleep (dwMilliseconds=0xa) [0092.250] timeGetTime () returned 0xa6fb42 [0092.250] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.250] Sleep (dwMilliseconds=0xa) [0092.268] timeGetTime () returned 0xa6fb51 [0092.268] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.268] Sleep (dwMilliseconds=0xa) [0092.305] timeGetTime () returned 0xa6fb80 [0092.305] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.305] Sleep (dwMilliseconds=0xa) [0092.316] timeGetTime () returned 0xa6fb90 [0092.316] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.316] Sleep (dwMilliseconds=0xa) [0092.332] timeGetTime () returned 0xa6fb9f [0092.332] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.332] Sleep (dwMilliseconds=0xa) [0092.364] timeGetTime () returned 0xa6fbbe [0092.364] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.364] Sleep (dwMilliseconds=0xa) [0092.378] timeGetTime () returned 0xa6fbce [0092.378] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.378] Sleep (dwMilliseconds=0xa) [0092.425] timeGetTime () returned 0xa6fbfd [0092.425] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.425] Sleep (dwMilliseconds=0xa) [0092.461] timeGetTime () returned 0xa6fc1c [0092.461] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.461] Sleep (dwMilliseconds=0xa) [0092.477] timeGetTime () returned 0xa6fc2c [0092.477] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.477] Sleep (dwMilliseconds=0xa) [0092.491] timeGetTime () returned 0xa6fc3b [0092.491] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.491] Sleep (dwMilliseconds=0xa) [0092.530] timeGetTime () returned 0xa6fc5a [0092.530] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.530] Sleep (dwMilliseconds=0xa) [0092.538] timeGetTime () returned 0xa6fc6a [0092.538] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.538] Sleep (dwMilliseconds=0xa) [0092.551] timeGetTime () returned 0xa6fc7a [0092.551] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.551] Sleep (dwMilliseconds=0xa) [0092.577] timeGetTime () returned 0xa6fc89 [0092.578] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.578] Sleep (dwMilliseconds=0xa) [0092.712] timeGetTime () returned 0xa6fca8 [0092.712] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.712] Sleep (dwMilliseconds=0xa) [0092.734] timeGetTime () returned 0xa6fcb8 [0092.734] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.734] Sleep (dwMilliseconds=0xa) [0092.743] timeGetTime () returned 0xa6fcc8 [0092.743] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.743] Sleep (dwMilliseconds=0xa) [0092.759] timeGetTime () returned 0xa6fcd7 [0092.759] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.759] Sleep (dwMilliseconds=0xa) [0092.796] timeGetTime () returned 0xa6fcf6 [0092.796] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.796] Sleep (dwMilliseconds=0xa) [0092.830] timeGetTime () returned 0xa6fd25 [0092.830] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 1 [0092.830] TranslateMessage (lpMsg=0x90f554) returned 0 [0092.830] DispatchMessageW (lpMsg=0x90f554) returned 0x0 [0092.830] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0092.830] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0092.830] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.831] Sleep (dwMilliseconds=0xa) [0092.849] timeGetTime () returned 0xa6fd35 [0092.849] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.849] Sleep (dwMilliseconds=0xa) [0092.862] timeGetTime () returned 0xa6fd44 [0092.862] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.862] Sleep (dwMilliseconds=0xa) [0092.909] timeGetTime () returned 0xa6fd73 [0092.910] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.917] Sleep (dwMilliseconds=0xa) [0092.985] timeGetTime () returned 0xa6fdb2 [0092.985] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0092.985] Sleep (dwMilliseconds=0xa) [0093.051] timeGetTime () returned 0xa6fe00 [0093.051] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0093.051] Sleep (dwMilliseconds=0xa) [0093.110] timeGetTime () returned 0xa6fe2e [0093.110] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0093.110] Sleep (dwMilliseconds=0xa) [0093.113] timeGetTime () returned 0xa6fe3e [0093.113] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0093.113] Sleep (dwMilliseconds=0xa) [0093.135] timeGetTime () returned 0xa6fe4e [0093.135] PeekMessageW (in: lpMsg=0x90f554, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f554) returned 0 [0093.135] Sleep (dwMilliseconds=0xa) [0093.148] timeGetTime () returned 0xa6fe5d [0093.148] PeekMessageW (in: lpMsg=0x90f73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f73c) returned 0 [0093.148] CharUpperBuffW (in: lpsz="CUKXVXVZGVOUEYETKUUTEC", cchLength=0x16 | out: lpsz="CUKXVXVZGVOUEYETKUUTEC") returned 0x16 [0093.149] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.149] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 0xffffffff [0093.149] FindFirstFileW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", lpFindFileData=0x90ee48 | out: lpFindFileData=0x90ee48) returned 0xffffffff [0093.149] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.149] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.149] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.149] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.150] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.150] CharUpperBuffW (in: lpsz="LMGXO__VIDUBLBNQ_URO", cchLength=0x14 | out: lpsz="LMGXO__VIDUBLBNQ_URO") returned 0x14 [0093.150] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.150] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.150] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.150] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.151] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.152] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.153] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.154] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.155] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.156] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.157] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.158] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.159] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.160] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.160] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.160] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.160] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 0xffffffff [0093.160] GetLastError () returned 0x2 [0093.160] CreateDirectoryW (lpPathName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr"), lpSecurityAttributes=0x0) returned 1 [0093.161] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.161] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.161] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.161] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.167] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.167] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.167] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.167] CharUpperBuffW (in: lpsz="CUHEVSXEDUELZVLIEXJU", cchLength=0x14 | out: lpsz="CUHEVSXEDUELZVLIEXJU") returned 0x14 [0093.167] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.167] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.167] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.167] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.167] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.167] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.168] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", nBufferLength=0x7fff, lpBuffer=0x8fec68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFilePart=0x0) returned 0x5c [0093.168] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0x8fec68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0093.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:", cchCount1=2, lpString2="C:", cchCount2=2) returned 2 [0093.168] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe")) returned 0x20 [0093.168] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0xffffffff [0093.168] FindFirstFileW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", lpFindFileData=0x90ec80 | out: lpFindFileData=0x90ec80) returned 0xd31f70 [0093.168] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0xffffffff [0093.169] FindFirstFileW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFindFileData=0x90ea10 | out: lpFindFileData=0x90ea10) returned 0xffffffff [0093.169] CopyFileExW (lpExistingFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe"), lpNewFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe"), lpProgressRoutine=0x0, lpData=0x0, pbCancel=0x90ec64, dwCopyFlags=0x8) returned 1 [0093.434] FindNextFileW (in: hFindFile=0xd31f70, lpFindFileData=0x90ec80 | out: lpFindFileData=0x90ec80) returned 0 [0093.434] FindClose (in: hFindFile=0xd31f70 | out: hFindFile=0xd31f70) returned 1 [0093.434] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.435] CharUpperBuffW (in: lpsz="ZFRTZZSAHZYYERUFUTKH", cchLength=0x14 | out: lpsz="ZFRTZZSAHZYYERUFUTKH") returned 0x14 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.435] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.436] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.437] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.438] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.439] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.440] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.440] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.440] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.440] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.440] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.442] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.443] EnumWindows (lpEnumFunc=0x28b196, lParam=0x2f5500) returned 1 [0093.443] GetWindowTextW (in: hWnd=0x10014, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.443] GetClassNameW (in: hWnd=0x10014, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="#32774") returned 6 [0093.444] GetWindowTextW (in: hWnd=0x10066, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.444] GetClassNameW (in: hWnd=0x10066, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.444] GetWindowTextW (in: hWnd=0x10064, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.444] GetClassNameW (in: hWnd=0x10064, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.444] GetWindowTextW (in: hWnd=0x10050, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.444] GetClassNameW (in: hWnd=0x10050, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.444] GetWindowTextW (in: hWnd=0x10078, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.444] GetClassNameW (in: hWnd=0x10078, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.444] GetWindowTextW (in: hWnd=0x1006e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.444] GetClassNameW (in: hWnd=0x1006e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.444] GetWindowTextW (in: hWnd=0x1006c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.444] GetClassNameW (in: hWnd=0x1006c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.444] GetWindowTextW (in: hWnd=0x10068, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.444] GetClassNameW (in: hWnd=0x10068, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.444] GetWindowTextW (in: hWnd=0x10048, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Start") returned 5 [0093.444] GetClassNameW (in: hWnd=0x10048, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0093.444] GetWindowTextW (in: hWnd=0x2001e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.444] GetClassNameW (in: hWnd=0x2001e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0093.444] GetWindowTextW (in: hWnd=0x1011c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0093.444] GetClassNameW (in: hWnd=0x1011c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0093.444] GetWindowTextW (in: hWnd=0x10114, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0093.444] GetClassNameW (in: hWnd=0x10114, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0093.444] GetWindowTextW (in: hWnd=0x100da, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.445] GetClassNameW (in: hWnd=0x100da, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.445] GetWindowTextW (in: hWnd=0x100cc, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.445] GetClassNameW (in: hWnd=0x100cc, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.445] GetWindowTextW (in: hWnd=0x100bc, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.445] GetClassNameW (in: hWnd=0x100bc, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.445] GetWindowTextW (in: hWnd=0x10094, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.445] GetClassNameW (in: hWnd=0x10094, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.445] GetWindowTextW (in: hWnd=0x50082, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.445] GetClassNameW (in: hWnd=0x50082, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.445] GetWindowTextW (in: hWnd=0x1007a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.445] GetClassNameW (in: hWnd=0x1007a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0093.445] GetWindowTextW (in: hWnd=0x1008c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0093.445] GetClassNameW (in: hWnd=0x1008c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0093.445] GetWindowTextW (in: hWnd=0x2020a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.445] GetClassNameW (in: hWnd=0x2020a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="MsiHiddenWindow") returned 15 [0093.445] GetWindowTextW (in: hWnd=0x2026e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.445] GetClassNameW (in: hWnd=0x2026e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="ThunderMain") returned 11 [0093.445] GetWindowTextW (in: hWnd=0x301c6, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Access - October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93 : Database- C:\\Users\\JPenUM\\Desktop\\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde ") returned 159 [0093.445] GetClassNameW (in: hWnd=0x301c6, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="OMain") returned 5 [0093.445] GetWindowTextW (in: hWnd=0x30282, lpString=0x90e6b8, nMaxCount=1024 | out: lpString=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0093.445] GetClassNameW (in: hWnd=0x30282, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0093.445] GetWindowTextW (in: hWnd=0x20286, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.445] GetClassNameW (in: hWnd=0x20286, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0093.445] GetWindowTextW (in: hWnd=0x2022c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x2022c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x301b8, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x301b8, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x3019a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x3019a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x20228, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x20228, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x20238, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x20238, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x20234, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x20234, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x20220, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x20220, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x2025c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x2025c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x20266, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x20266, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x20268, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x20268, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x20246, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x20246, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x20254, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.446] GetClassNameW (in: hWnd=0x20254, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.446] GetWindowTextW (in: hWnd=0x20250, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.447] GetClassNameW (in: hWnd=0x20250, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.447] GetWindowTextW (in: hWnd=0x2024a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.447] GetClassNameW (in: hWnd=0x2024a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.447] GetWindowTextW (in: hWnd=0x2024c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.447] GetClassNameW (in: hWnd=0x2024c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.447] GetWindowTextW (in: hWnd=0x2021e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.447] GetClassNameW (in: hWnd=0x2021e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.447] GetWindowTextW (in: hWnd=0x2020e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.447] GetClassNameW (in: hWnd=0x2020e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.447] GetWindowTextW (in: hWnd=0x20216, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.447] GetClassNameW (in: hWnd=0x20216, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.447] GetWindowTextW (in: hWnd=0x201f6, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0093.447] GetClassNameW (in: hWnd=0x201f6, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0093.447] GetWindowTextW (in: hWnd=0x30130, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0093.447] GetClassNameW (in: hWnd=0x30130, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0093.447] GetWindowTextW (in: hWnd=0x301e2, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0093.447] DefWindowProcW (hWnd=0x301e2, Msg=0xd, wParam=0x400, lParam=0x90e6b8) returned 0x9 [0093.447] GetClassNameW (in: hWnd=0x301e2, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0093.447] GetWindowTextW (in: hWnd=0x10244, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.447] GetClassNameW (in: hWnd=0x10244, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0093.447] GetWindowTextW (in: hWnd=0x201e4, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="C") returned 1 [0093.447] GetClassNameW (in: hWnd=0x201e4, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="CFD File Open Message Window") returned 28 [0093.448] GetWindowTextW (in: hWnd=0x3018c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.448] GetClassNameW (in: hWnd=0x3018c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="MsoStdCompMgr") returned 13 [0093.448] GetWindowTextW (in: hWnd=0x401c2, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0093.448] GetClassNameW (in: hWnd=0x401c2, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0093.448] GetWindowTextW (in: hWnd=0x201c8, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0093.448] GetClassNameW (in: hWnd=0x201c8, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0093.448] GetWindowTextW (in: hWnd=0x501ac, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0093.448] GetClassNameW (in: hWnd=0x501ac, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0093.448] GetWindowTextW (in: hWnd=0x200e8, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.448] GetClassNameW (in: hWnd=0x200e8, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0093.448] GetWindowTextW (in: hWnd=0x200e6, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.448] GetClassNameW (in: hWnd=0x200e6, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0093.448] GetWindowTextW (in: hWnd=0x501ae, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.448] GetClassNameW (in: hWnd=0x501ae, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0093.448] GetWindowTextW (in: hWnd=0x20198, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Oil") returned 3 [0093.448] GetClassNameW (in: hWnd=0x20198, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0093.448] GetWindowTextW (in: hWnd=0x20178, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0093.448] GetClassNameW (in: hWnd=0x20178, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0093.448] GetWindowTextW (in: hWnd=0x20176, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Runner") returned 6 [0093.448] GetClassNameW (in: hWnd=0x20176, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0093.448] GetWindowTextW (in: hWnd=0x2016e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0093.448] GetClassNameW (in: hWnd=0x2016e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0093.449] GetWindowTextW (in: hWnd=0x2016a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0093.449] GetClassNameW (in: hWnd=0x2016a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0093.449] GetWindowTextW (in: hWnd=0x3019e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0093.449] GetClassNameW (in: hWnd=0x3019e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0093.449] GetWindowTextW (in: hWnd=0x30188, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0093.449] GetClassNameW (in: hWnd=0x30188, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0093.449] GetWindowTextW (in: hWnd=0x20164, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Charging") returned 8 [0093.449] GetClassNameW (in: hWnd=0x20164, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0093.449] GetWindowTextW (in: hWnd=0x20160, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0093.449] GetClassNameW (in: hWnd=0x20160, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0093.449] GetWindowTextW (in: hWnd=0x2015c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0093.449] GetClassNameW (in: hWnd=0x2015c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0093.449] GetWindowTextW (in: hWnd=0x20158, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0093.449] GetClassNameW (in: hWnd=0x20158, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0093.449] GetWindowTextW (in: hWnd=0x40152, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0093.449] GetClassNameW (in: hWnd=0x40152, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0093.449] GetWindowTextW (in: hWnd=0xd013a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0093.449] GetClassNameW (in: hWnd=0xd013a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0093.449] GetWindowTextW (in: hWnd=0x301bc, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0093.449] GetClassNameW (in: hWnd=0x301bc, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0093.449] GetWindowTextW (in: hWnd=0x300dc, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0093.449] GetClassNameW (in: hWnd=0x300dc, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0093.450] GetWindowTextW (in: hWnd=0x30174, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0093.450] GetClassNameW (in: hWnd=0x30174, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0093.450] GetWindowTextW (in: hWnd=0x20148, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0093.450] GetClassNameW (in: hWnd=0x20148, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0093.450] GetWindowTextW (in: hWnd=0x20142, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0093.450] GetClassNameW (in: hWnd=0x20142, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0093.450] GetWindowTextW (in: hWnd=0x30144, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0093.450] GetClassNameW (in: hWnd=0x30144, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0093.450] GetWindowTextW (in: hWnd=0x901b0, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0093.450] GetClassNameW (in: hWnd=0x901b0, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0093.450] GetWindowTextW (in: hWnd=0x501a4, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0093.450] GetClassNameW (in: hWnd=0x501a4, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0093.450] GetWindowTextW (in: hWnd=0x201a8, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0093.450] GetClassNameW (in: hWnd=0x201a8, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0093.450] GetWindowTextW (in: hWnd=0x2014e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.450] GetClassNameW (in: hWnd=0x2014e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0093.450] GetWindowTextW (in: hWnd=0x101be, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0093.450] GetClassNameW (in: hWnd=0x101be, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0093.450] GetWindowTextW (in: hWnd=0x4013c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0093.450] GetClassNameW (in: hWnd=0x4013c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0093.450] GetWindowTextW (in: hWnd=0x10128, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0093.450] GetClassNameW (in: hWnd=0x10128, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0093.450] GetWindowTextW (in: hWnd=0x20126, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0093.450] GetClassNameW (in: hWnd=0x20126, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0093.451] GetWindowTextW (in: hWnd=0x2011a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.451] GetClassNameW (in: hWnd=0x2011a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0093.451] GetWindowTextW (in: hWnd=0x1010a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0093.451] GetClassNameW (in: hWnd=0x1010a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0093.451] GetWindowTextW (in: hWnd=0x10102, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.451] GetClassNameW (in: hWnd=0x10102, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0093.451] GetWindowTextW (in: hWnd=0x100f8, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0093.451] GetClassNameW (in: hWnd=0x100f8, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0093.451] GetWindowTextW (in: hWnd=0x100f6, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.451] GetClassNameW (in: hWnd=0x100f6, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0093.451] GetWindowTextW (in: hWnd=0x100ee, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.451] GetClassNameW (in: hWnd=0x100ee, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0093.451] GetWindowTextW (in: hWnd=0x20034, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.451] GetClassNameW (in: hWnd=0x20034, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0093.451] GetWindowTextW (in: hWnd=0x100c6, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.451] GetClassNameW (in: hWnd=0x100c6, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.451] GetWindowTextW (in: hWnd=0x100c2, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.451] GetClassNameW (in: hWnd=0x100c2, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0093.451] GetWindowTextW (in: hWnd=0x100b6, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.451] GetClassNameW (in: hWnd=0x100b6, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0093.451] GetWindowTextW (in: hWnd=0x100ac, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.451] GetClassNameW (in: hWnd=0x100ac, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.452] GetWindowTextW (in: hWnd=0x100a6, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.452] GetClassNameW (in: hWnd=0x100a6, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.452] GetWindowTextW (in: hWnd=0x200a0, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.452] GetClassNameW (in: hWnd=0x200a0, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.452] GetWindowTextW (in: hWnd=0x10086, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0093.452] GetClassNameW (in: hWnd=0x10086, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0093.452] GetWindowTextW (in: hWnd=0x5007c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0093.452] GetClassNameW (in: hWnd=0x5007c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0093.452] GetWindowTextW (in: hWnd=0x40024, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.452] GetClassNameW (in: hWnd=0x40024, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0093.452] GetWindowTextW (in: hWnd=0x10072, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.452] GetClassNameW (in: hWnd=0x10072, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0093.452] GetWindowTextW (in: hWnd=0x1006a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.452] GetClassNameW (in: hWnd=0x1006a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.452] GetWindowTextW (in: hWnd=0x10058, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.452] GetClassNameW (in: hWnd=0x10058, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0093.452] GetWindowTextW (in: hWnd=0x100e2, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.452] GetClassNameW (in: hWnd=0x100e2, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0093.452] GetWindowTextW (in: hWnd=0x10054, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.452] GetClassNameW (in: hWnd=0x10054, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0093.452] GetWindowTextW (in: hWnd=0x2001a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0093.452] GetClassNameW (in: hWnd=0x2001a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0093.452] GetWindowTextW (in: hWnd=0x30028, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.452] GetClassNameW (in: hWnd=0x30028, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0093.453] GetWindowTextW (in: hWnd=0x3002c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.453] GetClassNameW (in: hWnd=0x3002c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0093.453] GetWindowTextW (in: hWnd=0x1003a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0093.453] GetClassNameW (in: hWnd=0x1003a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0093.453] GetWindowTextW (in: hWnd=0x1002e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0093.453] GetClassNameW (in: hWnd=0x1002e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0093.453] GetWindowTextW (in: hWnd=0x10036, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="") returned 0 [0093.453] GetClassNameW (in: hWnd=0x10036, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0093.453] GetWindowTextW (in: hWnd=0x30026, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0093.453] GetClassNameW (in: hWnd=0x30026, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0093.453] GetWindowTextW (in: hWnd=0x100d0, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0093.453] GetClassNameW (in: hWnd=0x100d0, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0093.453] GetWindowTextW (in: hWnd=0x20020, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0093.453] GetClassNameW (in: hWnd=0x20020, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0093.453] GetWindowTextW (in: hWnd=0x20022, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.453] GetClassNameW (in: hWnd=0x20022, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.453] GetWindowTextW (in: hWnd=0x10116, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.453] GetClassNameW (in: hWnd=0x10116, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.453] GetWindowTextW (in: hWnd=0x20208, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.453] GetClassNameW (in: hWnd=0x20208, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.453] GetWindowTextW (in: hWnd=0x101de, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0093.453] GetClassNameW (in: hWnd=0x101de, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0093.453] GetWindowTextW (in: hWnd=0x40184, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.453] GetClassNameW (in: hWnd=0x40184, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.454] GetWindowTextW (in: hWnd=0x20278, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.454] GetClassNameW (in: hWnd=0x20278, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.454] GetWindowTextW (in: hWnd=0x301f8, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.454] GetClassNameW (in: hWnd=0x301f8, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.454] GetWindowTextW (in: hWnd=0x2022e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0093.454] GetClassNameW (in: hWnd=0x2022e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0093.454] GetWindowTextW (in: hWnd=0x30200, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.468] GetClassNameW (in: hWnd=0x30200, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.468] GetWindowTextW (in: hWnd=0x20206, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.468] GetClassNameW (in: hWnd=0x20206, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.468] GetWindowTextW (in: hWnd=0x201d2, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.468] GetClassNameW (in: hWnd=0x201d2, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.468] GetWindowTextW (in: hWnd=0x20182, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x20182, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x20180, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x20180, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x20170, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x20170, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x2016c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x2016c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x20168, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x20168, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x3019c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x3019c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x20166, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x20166, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x20162, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x20162, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x2015e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x2015e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x2015a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x2015a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x20156, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.469] GetClassNameW (in: hWnd=0x20156, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.469] GetWindowTextW (in: hWnd=0x40150, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.470] GetClassNameW (in: hWnd=0x40150, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.470] GetWindowTextW (in: hWnd=0x201ba, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.470] GetClassNameW (in: hWnd=0x201ba, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.470] GetWindowTextW (in: hWnd=0x20172, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.470] GetClassNameW (in: hWnd=0x20172, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.470] GetWindowTextW (in: hWnd=0x4010e, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.470] GetClassNameW (in: hWnd=0x4010e, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.470] GetWindowTextW (in: hWnd=0x2014a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.470] GetClassNameW (in: hWnd=0x2014a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.470] GetWindowTextW (in: hWnd=0x20146, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.470] GetClassNameW (in: hWnd=0x20146, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.470] GetWindowTextW (in: hWnd=0x30140, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.470] GetClassNameW (in: hWnd=0x30140, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.470] GetWindowTextW (in: hWnd=0x20154, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.470] GetClassNameW (in: hWnd=0x20154, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.471] GetWindowTextW (in: hWnd=0x101c0, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.471] GetClassNameW (in: hWnd=0x101c0, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.471] GetWindowTextW (in: hWnd=0x1010c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.471] GetClassNameW (in: hWnd=0x1010c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.471] GetWindowTextW (in: hWnd=0x10104, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.471] GetClassNameW (in: hWnd=0x10104, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.471] GetWindowTextW (in: hWnd=0x100fa, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.471] GetClassNameW (in: hWnd=0x100fa, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.471] GetWindowTextW (in: hWnd=0x1003c, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.471] GetClassNameW (in: hWnd=0x1003c, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.471] GetWindowTextW (in: hWnd=0x10030, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.471] GetClassNameW (in: hWnd=0x10030, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.471] GetWindowTextW (in: hWnd=0x10038, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.471] GetClassNameW (in: hWnd=0x10038, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.471] GetWindowTextW (in: hWnd=0x100ec, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0093.471] GetClassNameW (in: hWnd=0x100ec, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0093.471] GetWindowTextW (in: hWnd=0x2002a, lpString=0x90e6b8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0093.471] GetClassNameW (in: hWnd=0x2002a, lpClassName=0x90e6b8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0093.471] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.471] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90f4e4) returned 0 [0093.472] CharUpperBuffW (in: lpsz="LMGXO__VIDUBLBNQ_URO", cchLength=0x14 | out: lpsz="LMGXO__VIDUBLBNQ_URO") returned 0x14 [0093.472] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.472] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.473] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.474] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.475] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.479] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.480] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.481] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.482] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.484] CharUpperBuffW (in: lpsz="CUHEVSXEDUELZVLIEXJU", cchLength=0x14 | out: lpsz="CUHEVSXEDUELZVLIEXJU") returned 0x14 [0093.486] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0x8de960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0093.486] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0x8eef98 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.486] SetCurrentDirectoryW (lpPathName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 1 [0093.487] GetFileAttributesW (lpFileName="RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x2020 [0093.487] FindFirstFileW (in: lpFileName="RtlUpd64.exe", lpFindFileData=0x8ee6f8 | out: lpFindFileData=0x8ee6f8) returned 0xd31f70 [0093.487] GetFileAttributesW (lpFileName="RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x2020 [0093.487] SetFileAttributesW (lpFileName="RtlUpd64.exe", dwFileAttributes=0x2023) returned 1 [0093.487] FindNextFileW (in: hFindFile=0xd31f70, lpFindFileData=0x8ee6f8 | out: lpFindFileData=0x8ee6f8) returned 0 [0093.487] FindClose (in: hFindFile=0xd31f70 | out: hFindFile=0xd31f70) returned 1 [0093.487] SetCurrentDirectoryW (lpPathName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 1 [0093.487] CharUpperBuffW (in: lpsz="KUJEVWMGAPXSFGHGYTMN", cchLength=0x14 | out: lpsz="KUJEVWMGAPXSFGHGYTMN") returned 0x14 [0093.505] PeekMessageW (in: lpMsg=0x90ec2c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec2c) returned 0 [0093.505] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", nBufferLength=0x7fff, lpBuffer=0x8de960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", lpFilePart=0x0) returned 0x26 [0093.505] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0x8eef98 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.505] SetCurrentDirectoryW (lpPathName="C:\\Users\\JPenUM\\AppData\\Roaming\\" (normalized: "c:\\users\\jpenum\\appdata\\roaming")) returned 1 [0093.505] GetFileAttributesW (lpFileName="appmgr" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 0x2010 [0093.505] GetFileAttributesW (lpFileName="appmgr" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 0x2010 [0093.505] SetFileAttributesW (lpFileName="appmgr", dwFileAttributes=0x2013) returned 1 [0093.506] SetCurrentDirectoryW (lpPathName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 1 [0093.506] CharUpperBuffW (in: lpsz="LPXKHVWBHHWHBOBTGAID", cchLength=0x14 | out: lpsz="LPXKHVWBHHWHBOBTGAID") returned 0x14 [0093.506] CharUpperBuffW (in: lpsz="XYDBLSCNDIODUIBUOMWE", cchLength=0x14 | out: lpsz="XYDBLSCNDIODUIBUOMWE") returned 0x14 [0093.506] CharUpperBuffW (in: lpsz="XLXFAITACZQESJDYDOJW", cchLength=0x14 | out: lpsz="XLXFAITACZQESJDYDOJW") returned 0x14 [0093.506] CharUpperBuffW (in: lpsz="CUHEVSXEDUELZVLIEXJU", cchLength=0x14 | out: lpsz="CUHEVSXEDUELZVLIEXJU") returned 0x14 [0093.507] CharUpperBuffW (in: lpsz="LVTDPVFBPHVXPQMTNUXB", cchLength=0x14 | out: lpsz="LVTDPVFBPHVXPQMTNUXB") returned 0x14 [0093.508] PeekMessageW (in: lpMsg=0x90ec64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x90ec64) returned 0 [0093.508] ShellExecuteExW (in: pExecInfo=0x90ef20*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="schtasks", lpParameters="/create /tn RtkAudioService64 /tr \"C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe\" /sc minute /mo 1 /F", lpDirectory="C:\\Windows\\system32", nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x90ef20*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="schtasks", lpParameters="/create /tn RtkAudioService64 /tr \"C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe\" /sc minute /mo 1 /F", lpDirectory="C:\\Windows\\system32", nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x330)) returned 1 [0093.605] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0093.605] SetTimer (hWnd=0x301e2, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0093.669] GetProcessId (Process=0x330) returned 0xa18 [0093.669] CloseHandle (hObject=0x330) returned 1 [0093.669] CharUpperBuffW (in: lpsz="EOYHLBQUNPHWLCZHVIPGMR", cchLength=0x16 | out: lpsz="EOYHLBQUNPHWLCZHVIPGMR") returned 0x16 [0093.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files", cchCount1=80, lpString2="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", cchCount2=38) returned 1 [0093.670] CharUpperBuffW (in: lpsz="LBKYTTUGWOPLNRBUXJVF", cchLength=0x14 | out: lpsz="LBKYTTUGWOPLNRBUXJVF") returned 0x14 [0093.670] CharUpperBuffW (in: lpsz="GYAAGFSRUS_WEXXHMQDR", cchLength=0x14 | out: lpsz="GYAAGFSRUS_WEXXHMQDR") returned 0x14 [0093.670] ShellExecuteExW (in: pExecInfo=0x90ef20*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="C:\\Windows\\system32\\cmd.exe", lpParameters="/k ping 127.0.0.1 -t 0 & del C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe & exit ", lpDirectory="", nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x90ef20*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="C:\\Windows\\system32\\cmd.exe", lpParameters="/k ping 127.0.0.1 -t 0 & del C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe & exit ", lpDirectory="", nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x2fc)) returned 1 [0094.099] GetProcessId (Process=0x2fc) returned 0xa20 [0094.099] CloseHandle (hObject=0x2fc) returned 1 [0094.099] LockWindowUpdate (hWndLock=0x0) returned 0 [0094.099] DestroyWindow (hWnd=0x301e2) returned 1 [0094.099] DefWindowProcW (hWnd=0x301e2, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0094.099] KillTimer (hWnd=0x301e2, uIDEvent=0x1) returned 1 [0094.100] PostQuitMessage (nExitCode=0) [0094.100] GetMessageW (in: lpMsg=0x90f7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x90f7f4) returned 0 [0094.400] SetCurrentDirectoryW (lpPathName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 1 [0094.400] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 0 [0094.400] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0094.452] OleUninitialize () [0094.715] DestroyCursor (hCursor=0x1501d7) returned 0 [0094.715] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x92f82c | out: phModule=0x92f82c) returned 0 [0094.715] ExitProcess (uExitCode=0x0) Thread: id = 154 os_tid = 0x428 Thread: id = 155 os_tid = 0x44c Thread: id = 156 os_tid = 0x4b8 Thread: id = 157 os_tid = 0x4e4 Thread: id = 158 os_tid = 0x118 Thread: id = 213 os_tid = 0xa14 Thread: id = 215 os_tid = 0xa0c Process: id = "10" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x7f1f63c0" os_pid = "0x178" os_integrity_level = "0x2000" os_privileges = "0x880000" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x30c" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}" cur_dir = "C:\\Windows\\system32\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1802 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1803 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1804 start_va = 0x30000 end_va = 0x6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1805 start_va = 0x70000 end_va = 0x73fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1806 start_va = 0x80000 end_va = 0xe6fff entry_point = 0x80000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1807 start_va = 0xf0000 end_va = 0x1b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1808 start_va = 0x1c0000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1809 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1810 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1811 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1812 start_va = 0x200000 end_va = 0x201fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 1813 start_va = 0x210000 end_va = 0x210fff entry_point = 0x210000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 1814 start_va = 0x230000 end_va = 0x231fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 1815 start_va = 0x240000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 1816 start_va = 0x340000 end_va = 0x440fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 1817 start_va = 0x470000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1818 start_va = 0x580000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 1819 start_va = 0x600000 end_va = 0x63ffff entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 1820 start_va = 0x640000 end_va = 0x90efff entry_point = 0x640000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1821 start_va = 0x910000 end_va = 0x94ffff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 1822 start_va = 0x990000 end_va = 0x9cffff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 1823 start_va = 0xa70000 end_va = 0xaaffff entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1824 start_va = 0xab0000 end_va = 0xb8efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 1825 start_va = 0xc80000 end_va = 0xc8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 1826 start_va = 0xcb0000 end_va = 0xcb4fff entry_point = 0xcb0000 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 1827 start_va = 0xcc0000 end_va = 0x18bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cc0000" filename = "" Region: id = 1828 start_va = 0x18c0000 end_va = 0x19bffff entry_point = 0x0 region_type = private name = "private_0x00000000018c0000" filename = "" Region: id = 1829 start_va = 0x62c00000 end_va = 0x62dc2fff entry_point = 0x62c00000 region_type = mapped_file name = "d3d9.dll" filename = "\\Windows\\System32\\d3d9.dll" (normalized: "c:\\windows\\system32\\d3d9.dll") Region: id = 1830 start_va = 0x6b490000 end_va = 0x6b5f5fff entry_point = 0x6b490000 region_type = mapped_file name = "photoviewer.dll" filename = "\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll") Region: id = 1831 start_va = 0x6da80000 end_va = 0x6dabbfff entry_point = 0x6da80000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 1832 start_va = 0x73850000 end_va = 0x739dffff entry_point = 0x73850000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 1833 start_va = 0x73c20000 end_va = 0x73d1afff entry_point = 0x73c20000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 1834 start_va = 0x73d20000 end_va = 0x73d32fff entry_point = 0x73d20000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1835 start_va = 0x73dd0000 end_va = 0x73ddbfff entry_point = 0x73dd0000 region_type = mapped_file name = "photobase.dll" filename = "\\Program Files\\Windows Photo Viewer\\PhotoBase.dll" (normalized: "c:\\program files\\windows photo viewer\\photobase.dll") Region: id = 1836 start_va = 0x73de0000 end_va = 0x73de5fff entry_point = 0x73de0000 region_type = mapped_file name = "d3d8thk.dll" filename = "\\Windows\\System32\\d3d8thk.dll" (normalized: "c:\\windows\\system32\\d3d8thk.dll") Region: id = 1837 start_va = 0x74060000 end_va = 0x7409ffff entry_point = 0x74060000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1838 start_va = 0x744c0000 end_va = 0x744ccfff entry_point = 0x744c0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1839 start_va = 0x744d0000 end_va = 0x744d9fff entry_point = 0x744d0000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1840 start_va = 0x74a10000 end_va = 0x74badfff entry_point = 0x74a10000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 1841 start_va = 0x74f80000 end_va = 0x74f88fff entry_point = 0x74f80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1842 start_va = 0x752a0000 end_va = 0x752dafff entry_point = 0x752a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1843 start_va = 0x75500000 end_va = 0x75515fff entry_point = 0x75500000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1844 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1845 start_va = 0x75a20000 end_va = 0x75a2dfff entry_point = 0x75a20000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1846 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1847 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1848 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1849 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1850 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1851 start_va = 0x75f10000 end_va = 0x76b59fff entry_point = 0x75f10000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1852 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1853 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1854 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1855 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1856 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1857 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1858 start_va = 0x771d0000 end_va = 0x77226fff entry_point = 0x771d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1859 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1860 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1861 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1862 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1863 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1864 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1865 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 1866 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 1867 start_va = 0x7ffd4000 end_va = 0x7ffd4fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd4000" filename = "" Region: id = 1868 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 1869 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 1870 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 1871 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 1872 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 1873 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 1874 start_va = 0x748d0000 end_va = 0x749c4fff entry_point = 0x748d0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1878 start_va = 0x220000 end_va = 0x221fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1879 start_va = 0x450000 end_va = 0x450fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 1880 start_va = 0x460000 end_va = 0x461fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 1881 start_va = 0x4b0000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1882 start_va = 0xba0000 end_va = 0xbdffff entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 1883 start_va = 0x6d8e0000 end_va = 0x6d90afff entry_point = 0x6d8e0000 region_type = mapped_file name = "ieproxy.dll" filename = "\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll") Region: id = 1884 start_va = 0x70420000 end_va = 0x7044dfff entry_point = 0x70420000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 1885 start_va = 0x70f00000 end_va = 0x70f4bfff entry_point = 0x70f00000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1886 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 1887 start_va = 0x75a30000 end_va = 0x75a3afff entry_point = 0x75a30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1888 start_va = 0x748a0000 end_va = 0x748c0fff entry_point = 0x748a0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1889 start_va = 0x77890000 end_va = 0x778d4fff entry_point = 0x77890000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1890 start_va = 0x75c00000 end_va = 0x75c11fff entry_point = 0x75c00000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1891 start_va = 0x75c70000 end_va = 0x75c96fff entry_point = 0x75c70000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1892 start_va = 0x77410000 end_va = 0x775acfff entry_point = 0x77410000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1893 start_va = 0x530000 end_va = 0x536fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 1894 start_va = 0x540000 end_va = 0x541fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1895 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1896 start_va = 0x560000 end_va = 0x57ffff entry_point = 0x560000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000010.db" filename = "\\Users\\JPenUM\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000010.db" (normalized: "c:\\users\\jpenum\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000010.db") Region: id = 1897 start_va = 0x5c0000 end_va = 0x5c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 1898 start_va = 0xa30000 end_va = 0xa6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1899 start_va = 0x19c0000 end_va = 0x1db2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019c0000" filename = "" Region: id = 1900 start_va = 0x7ffd7000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd7000" filename = "" Region: id = 1901 start_va = 0x70450000 end_va = 0x7049dfff entry_point = 0x70450000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1902 start_va = 0x5d0000 end_va = 0x5d4fff entry_point = 0x5d0000 region_type = mapped_file name = "photoviewer.dll.mui" filename = "\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui") Region: id = 1903 start_va = 0x5e0000 end_va = 0x5e0fff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 1904 start_va = 0x5f0000 end_va = 0x5f0fff entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 1905 start_va = 0x950000 end_va = 0x950fff entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 1906 start_va = 0x960000 end_va = 0x960fff entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 1907 start_va = 0x970000 end_va = 0x970fff entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 1908 start_va = 0x980000 end_va = 0x980fff entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 1909 start_va = 0x9d0000 end_va = 0x9d0fff entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 1910 start_va = 0x9e0000 end_va = 0x9e3fff entry_point = 0x9e0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1911 start_va = 0x9f0000 end_va = 0xa1ffff entry_point = 0x9f0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db") Region: id = 1912 start_va = 0xa20000 end_va = 0xa23fff entry_point = 0xa20000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1913 start_va = 0xbe0000 end_va = 0xc45fff entry_point = 0xbe0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1914 start_va = 0x1e30000 end_va = 0x1e6ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 1915 start_va = 0x1f50000 end_va = 0x1f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 1916 start_va = 0x1f60000 end_va = 0x205ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 1917 start_va = 0x2100000 end_va = 0x213ffff entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 1918 start_va = 0x62a30000 end_va = 0x62bf9fff entry_point = 0x62a30000 region_type = mapped_file name = "imagingengine.dll" filename = "\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll") Region: id = 1919 start_va = 0x63050000 end_va = 0x630c8fff entry_point = 0x63050000 region_type = mapped_file name = "mscms.dll" filename = "\\Windows\\System32\\mscms.dll" (normalized: "c:\\windows\\system32\\mscms.dll") Region: id = 1920 start_va = 0x750e0000 end_va = 0x750f6fff entry_point = 0x750e0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1921 start_va = 0x7ffd6000 end_va = 0x7ffd6fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd6000" filename = "" Region: id = 1922 start_va = 0x7ffd8000 end_va = 0x7ffd8fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 1927 start_va = 0xb90000 end_va = 0xb9ffff entry_point = 0xb90000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1928 start_va = 0xc50000 end_va = 0xc5ffff entry_point = 0xc50000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1929 start_va = 0xc60000 end_va = 0xc6ffff entry_point = 0xc60000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1930 start_va = 0xc70000 end_va = 0xc7ffff entry_point = 0xc70000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1931 start_va = 0xc90000 end_va = 0xc9ffff entry_point = 0xc90000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1932 start_va = 0xca0000 end_va = 0xcaffff entry_point = 0xca0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1933 start_va = 0x1dc0000 end_va = 0x1dcffff entry_point = 0x1dc0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1934 start_va = 0x1dd0000 end_va = 0x1ddffff entry_point = 0x1dd0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1935 start_va = 0x1de0000 end_va = 0x1deffff entry_point = 0x1de0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1936 start_va = 0x1df0000 end_va = 0x1dfffff entry_point = 0x1df0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1937 start_va = 0x1e00000 end_va = 0x1e0ffff entry_point = 0x1e00000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1938 start_va = 0x1e10000 end_va = 0x1e1ffff entry_point = 0x1e10000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1939 start_va = 0x1e20000 end_va = 0x1e2ffff entry_point = 0x1e20000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1940 start_va = 0x1e70000 end_va = 0x1e7ffff entry_point = 0x1e70000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1941 start_va = 0x1e80000 end_va = 0x1e8ffff entry_point = 0x1e80000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1942 start_va = 0x1e90000 end_va = 0x1e9ffff entry_point = 0x1e90000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1943 start_va = 0x1ea0000 end_va = 0x1eaffff entry_point = 0x1ea0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1944 start_va = 0x1eb0000 end_va = 0x1ebffff entry_point = 0x1eb0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1945 start_va = 0x1ec0000 end_va = 0x1ecffff entry_point = 0x1ec0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1946 start_va = 0x1ed0000 end_va = 0x1edffff entry_point = 0x1ed0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1947 start_va = 0x1ee0000 end_va = 0x1eeffff entry_point = 0x1ee0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1948 start_va = 0x1ef0000 end_va = 0x1efffff entry_point = 0x1ef0000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1949 start_va = 0x1f00000 end_va = 0x1f00fff entry_point = 0x1f00000 region_type = mapped_file name = "srgb color space profile.icm" filename = "\\Windows\\System32\\spool\\drivers\\color\\sRGB Color Space Profile.icm" (normalized: "c:\\windows\\system32\\spool\\drivers\\color\\srgb color space profile.icm") Region: id = 1950 start_va = 0x1f10000 end_va = 0x1f1ffff entry_point = 0x1f10000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1951 start_va = 0x1f20000 end_va = 0x1f2ffff entry_point = 0x1f20000 region_type = mapped_file name = "~pie13d.tmp" filename = "\\Users\\JPenUM\\AppData\\Local\\Temp\\~PIE13D.tmp" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\~pie13d.tmp") Region: id = 1952 start_va = 0x2060000 end_va = 0x20d9fff entry_point = 0x2060000 region_type = mapped_file name = "segoeuib.ttf" filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf") Region: id = 1953 start_va = 0x2140000 end_va = 0x223dfff entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 1954 start_va = 0x22c0000 end_va = 0x22fffff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 1955 start_va = 0x6b450000 end_va = 0x6b487fff entry_point = 0x6b450000 region_type = mapped_file name = "icm32.dll" filename = "\\Windows\\System32\\icm32.dll" (normalized: "c:\\windows\\system32\\icm32.dll") Region: id = 1956 start_va = 0x7ffd5000 end_va = 0x7ffd5fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Thread: id = 159 os_tid = 0x8e4 Thread: id = 160 os_tid = 0x6d8 Thread: id = 161 os_tid = 0x708 Thread: id = 162 os_tid = 0x888 Thread: id = 163 os_tid = 0x874 Thread: id = 164 os_tid = 0x71c Thread: id = 165 os_tid = 0x244 Thread: id = 166 os_tid = 0x910 Thread: id = 167 os_tid = 0x91c Thread: id = 168 os_tid = 0x89c Thread: id = 169 os_tid = 0x774 Thread: id = 170 os_tid = 0x92c Thread: id = 171 os_tid = 0x620 Thread: id = 172 os_tid = 0x788 Thread: id = 173 os_tid = 0x608 Thread: id = 174 os_tid = 0x6cc Thread: id = 175 os_tid = 0x130 Thread: id = 176 os_tid = 0x7d8 Thread: id = 177 os_tid = 0x64 Process: id = "11" image_name = "regasm.exe" filename = "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe" page_root = "0x7f1f6660" os_pid = "0x24c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x30c" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1961 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1962 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1963 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1964 start_va = 0x200000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1965 start_va = 0x400000 end_va = 0x455fff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1966 start_va = 0xf70000 end_va = 0xf7ffff entry_point = 0xf70000 region_type = mapped_file name = "regasm.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe") Region: id = 1967 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1968 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1969 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 1970 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 1971 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 1972 start_va = 0x610000 end_va = 0x70ffff entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 1973 start_va = 0x6fce0000 end_va = 0x6fd29fff entry_point = 0x6fce0000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 1974 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1975 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1976 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1977 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1978 start_va = 0x120000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 1979 start_va = 0x3d0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 1980 start_va = 0x5d0000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 1981 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1982 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1983 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1984 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1985 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 1986 start_va = 0x698d0000 end_va = 0x69947fff entry_point = 0x698d0000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 1987 start_va = 0x130000 end_va = 0x1f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1988 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1989 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1990 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1991 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1992 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1993 start_va = 0x771d0000 end_va = 0x77226fff entry_point = 0x771d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1994 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1995 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1996 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1997 start_va = 0x460000 end_va = 0x560fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 1998 start_va = 0xf80000 end_va = 0x1b7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f80000" filename = "" Region: id = 1999 start_va = 0x74f80000 end_va = 0x74f88fff entry_point = 0x74f80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2000 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2001 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2002 start_va = 0x62480000 end_va = 0x62a2afff entry_point = 0x62480000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 2003 start_va = 0x62fb0000 end_va = 0x6304afff entry_point = 0x62fb0000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll") Region: id = 2004 start_va = 0x300000 end_va = 0x300fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000300000" filename = "" Region: id = 2005 start_va = 0x310000 end_va = 0x310fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 2006 start_va = 0x320000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2007 start_va = 0x330000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2008 start_va = 0x340000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2009 start_va = 0x350000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2010 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2011 start_va = 0x370000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 2012 start_va = 0x810000 end_va = 0x81ffff entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 2013 start_va = 0x890000 end_va = 0x98ffff entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 2014 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 2015 start_va = 0x75f10000 end_va = 0x76b59fff entry_point = 0x75f10000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2016 start_va = 0x380000 end_va = 0x380fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 2017 start_va = 0x990000 end_va = 0xc5efff entry_point = 0x990000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2018 start_va = 0x75a30000 end_va = 0x75a3afff entry_point = 0x75a30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2019 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2020 start_va = 0x710000 end_va = 0x7affff entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 2021 start_va = 0x1b80000 end_va = 0x3b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b80000" filename = "" Region: id = 2022 start_va = 0x570000 end_va = 0x5cbfff entry_point = 0x570000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2023 start_va = 0xce0000 end_va = 0xddffff entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 2024 start_va = 0x61980000 end_va = 0x62477fff entry_point = 0x61980000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll") Region: id = 2025 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 2026 start_va = 0x570000 end_va = 0x5cbfff entry_point = 0x570000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2027 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2028 start_va = 0x74060000 end_va = 0x7409ffff entry_point = 0x74060000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2029 start_va = 0xde0000 end_va = 0xefffff entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 2030 start_va = 0xde0000 end_va = 0xebefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 2031 start_va = 0xec0000 end_va = 0xefffff entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 2032 start_va = 0x390000 end_va = 0x392fff entry_point = 0x390000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls") Region: id = 2033 start_va = 0x3a0000 end_va = 0x3acfff entry_point = 0x3a0000 region_type = mapped_file name = "regasm.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe") Region: id = 2034 start_va = 0x752a0000 end_va = 0x752dafff entry_point = 0x752a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2035 start_va = 0x75500000 end_va = 0x75515fff entry_point = 0x75500000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2036 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 2037 start_va = 0x62f50000 end_va = 0x62faafff entry_point = 0x62f50000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll") Region: id = 2038 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 2039 start_va = 0x3e0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 2040 start_va = 0x3c0000 end_va = 0x3c4fff entry_point = 0x3c0000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 2041 start_va = 0x3f0000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 2042 start_va = 0x570000 end_va = 0x570fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 2043 start_va = 0x580000 end_va = 0x58ffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 2044 start_va = 0x7b0000 end_va = 0x7f0fff entry_point = 0x7b0000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 2045 start_va = 0x60340000 end_va = 0x60347fff entry_point = 0x60340000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll") Region: id = 2046 start_va = 0x820000 end_va = 0x873fff entry_point = 0x820000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorrc.dll") Region: id = 2047 start_va = 0x611e0000 end_va = 0x6197bfff entry_point = 0x611e0000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\system.ni.dll") Region: id = 2048 start_va = 0x570000 end_va = 0x57afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 2049 start_va = 0x3b80000 end_va = 0x3c28fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b80000" filename = "" Region: id = 2050 start_va = 0x3c30000 end_va = 0x4c2ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c30000" filename = "" Region: id = 2051 start_va = 0x4c30000 end_va = 0x4d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 2052 start_va = 0x590000 end_va = 0x5b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 2053 start_va = 0x3c30000 end_va = 0x4c2ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c30000" filename = "" Region: id = 2054 start_va = 0x4d60000 end_va = 0x5d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d60000" filename = "" Region: id = 2055 start_va = 0x5d60000 end_va = 0x5faffff entry_point = 0x0 region_type = private name = "private_0x0000000005d60000" filename = "" Region: id = 2056 start_va = 0x710000 end_va = 0x71ffff entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 2057 start_va = 0x720000 end_va = 0x72ffff entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 2058 start_va = 0x5c0000 end_va = 0x5cffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 2059 start_va = 0x730000 end_va = 0x736fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 2060 start_va = 0x740000 end_va = 0x741fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 2061 start_va = 0x5fb0000 end_va = 0x606ffff entry_point = 0x5fb0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2062 start_va = 0x6170000 end_va = 0x626ffff entry_point = 0x0 region_type = private name = "private_0x0000000006170000" filename = "" Region: id = 2063 start_va = 0x6340000 end_va = 0x643ffff entry_point = 0x0 region_type = private name = "private_0x0000000006340000" filename = "" Region: id = 2064 start_va = 0x602d0000 end_va = 0x6046afff entry_point = 0x602d0000 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualBas#\\08d608378aa405adc844f3cf36974b8c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualbas#\\08d608378aa405adc844f3cf36974b8c\\microsoft.visualbasic.ni.dll") Region: id = 2065 start_va = 0x60470000 end_va = 0x6104dfff entry_point = 0x60470000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\3afcd5168c7a6cb02eab99d7fd71e102\\system.windows.forms.ni.dll") Region: id = 2066 start_va = 0x61050000 end_va = 0x611d7fff entry_point = 0x61050000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\system.drawing.ni.dll") Region: id = 2067 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 2068 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 2069 start_va = 0x64b0000 end_va = 0x65affff entry_point = 0x0 region_type = private name = "private_0x00000000064b0000" filename = "" Region: id = 2070 start_va = 0x6640000 end_va = 0x673ffff entry_point = 0x0 region_type = private name = "private_0x0000000006640000" filename = "" Region: id = 2071 start_va = 0x75a20000 end_va = 0x75a2dfff entry_point = 0x75a20000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2072 start_va = 0x7ffd8000 end_va = 0x7ffd8fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 2073 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 2074 start_va = 0x6820000 end_va = 0x691ffff entry_point = 0x0 region_type = private name = "private_0x0000000006820000" filename = "" Region: id = 2075 start_va = 0x7ffd7000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd7000" filename = "" Region: id = 2076 start_va = 0x6ac0000 end_va = 0x6bbffff entry_point = 0x0 region_type = private name = "private_0x0000000006ac0000" filename = "" Region: id = 2077 start_va = 0x74420000 end_va = 0x74426fff entry_point = 0x74420000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2078 start_va = 0x74430000 end_va = 0x7444bfff entry_point = 0x74430000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2079 start_va = 0x77b00000 end_va = 0x77b05fff entry_point = 0x77b00000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2080 start_va = 0x7ffd6000 end_va = 0x7ffd6fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd6000" filename = "" Region: id = 2081 start_va = 0x75380000 end_va = 0x753c3fff entry_point = 0x75380000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2082 start_va = 0x76b60000 end_va = 0x76b94fff entry_point = 0x76b60000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2083 start_va = 0x6920000 end_va = 0x6a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000006920000" filename = "" Region: id = 2084 start_va = 0x750000 end_va = 0x78ffff entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2085 start_va = 0x74330000 end_va = 0x7433cfff entry_point = 0x74330000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2086 start_va = 0x742c0000 end_va = 0x742d1fff entry_point = 0x742c0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2087 start_va = 0x754c0000 end_va = 0x754fbfff entry_point = 0x754c0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2088 start_va = 0xc60000 end_va = 0xcbffff entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 2089 start_va = 0x75010000 end_va = 0x75014fff entry_point = 0x75010000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2090 start_va = 0x754b0000 end_va = 0x754b5fff entry_point = 0x754b0000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2091 start_va = 0x601d0000 end_va = 0x602c0fff entry_point = 0x601d0000 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuration\\bc09ad2d49d8535371845cd7532f9271\\system.configuration.ni.dll") Region: id = 2092 start_va = 0x5fc90000 end_va = 0x601c5fff entry_point = 0x5fc90000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\system.xml.ni.dll") Region: id = 2093 start_va = 0x790000 end_va = 0x7affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 2094 start_va = 0x800000 end_va = 0x80ffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 2095 start_va = 0x6bc0000 end_va = 0x6fb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006bc0000" filename = "" Region: id = 2096 start_va = 0x5fb80000 end_va = 0x5fc83fff entry_point = 0x5fb80000 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\system.management.ni.dll") Region: id = 2097 start_va = 0x71a0000 end_va = 0x729ffff entry_point = 0x0 region_type = private name = "private_0x00000000071a0000" filename = "" Region: id = 2098 start_va = 0x7ff50000 end_va = 0x7ff5ffff entry_point = 0x0 region_type = private name = "private_0x000000007ff50000" filename = "" Region: id = 2099 start_va = 0x7ff60000 end_va = 0x7ffaffff entry_point = 0x0 region_type = private name = "private_0x000000007ff60000" filename = "" Region: id = 2100 start_va = 0x7ffd5000 end_va = 0x7ffd5fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 2101 start_va = 0x880000 end_va = 0x880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 2102 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2103 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2104 start_va = 0xc60000 end_va = 0xc60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 2105 start_va = 0xc80000 end_va = 0xcbffff entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 2106 start_va = 0x71490000 end_va = 0x714a6fff entry_point = 0x71490000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2107 start_va = 0x71f00000 end_va = 0x71f5bfff entry_point = 0x71f00000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2108 start_va = 0x6070000 end_va = 0x616ffff entry_point = 0x0 region_type = private name = "private_0x0000000006070000" filename = "" Region: id = 2109 start_va = 0x6fc0000 end_va = 0x714ffff entry_point = 0x0 region_type = private name = "private_0x0000000006fc0000" filename = "" Region: id = 2110 start_va = 0x7320000 end_va = 0x741ffff entry_point = 0x0 region_type = private name = "private_0x0000000007320000" filename = "" Region: id = 2111 start_va = 0x719c0000 end_va = 0x719c9fff entry_point = 0x719c0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2112 start_va = 0x7ffd4000 end_va = 0x7ffd4fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd4000" filename = "" Region: id = 2113 start_va = 0x6a310000 end_va = 0x6a318fff entry_point = 0x6a310000 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\wminet_utils.dll") Region: id = 2114 start_va = 0xc70000 end_va = 0xc70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c70000" filename = "" Region: id = 2115 start_va = 0xcc0000 end_va = 0xccffff entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 2116 start_va = 0x74f0000 end_va = 0x75effff entry_point = 0x0 region_type = private name = "private_0x00000000074f0000" filename = "" Region: id = 2117 start_va = 0x7ffd3000 end_va = 0x7ffd3fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd3000" filename = "" Region: id = 2118 start_va = 0x715a0000 end_va = 0x715aefff entry_point = 0x715a0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2119 start_va = 0x719f0000 end_va = 0x71a85fff entry_point = 0x719f0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2120 start_va = 0x719d0000 end_va = 0x719e7fff entry_point = 0x719d0000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2121 start_va = 0x72a0000 end_va = 0x739ffff entry_point = 0x0 region_type = private name = "private_0x00000000072a0000" filename = "" Region: id = 2122 start_va = 0x7ffd4000 end_va = 0x7ffd4fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd4000" filename = "" Region: id = 2227 start_va = 0xcd0000 end_va = 0xcd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cd0000" filename = "" Region: id = 2228 start_va = 0xcd0000 end_va = 0xcd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cd0000" filename = "" Region: id = 2229 start_va = 0x75960000 end_va = 0x7597afff entry_point = 0x75960000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2230 start_va = 0x74590000 end_va = 0x7459ffff entry_point = 0x74590000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2231 start_va = 0x73a0000 end_va = 0x750ffff entry_point = 0x0 region_type = private name = "private_0x00000000073a0000" filename = "" Region: id = 2232 start_va = 0x7510000 end_va = 0x76affff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 2233 start_va = 0x742a0000 end_va = 0x742affff entry_point = 0x742a0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2234 start_va = 0x725e0000 end_va = 0x725f1fff entry_point = 0x725e0000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2235 start_va = 0x749f0000 end_va = 0x749f7fff entry_point = 0x749f0000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2236 start_va = 0x742e0000 end_va = 0x74317fff entry_point = 0x742e0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2237 start_va = 0x6270000 end_va = 0x631ffff entry_point = 0x0 region_type = private name = "private_0x0000000006270000" filename = "" Region: id = 2238 start_va = 0x71ef0000 end_va = 0x71ef5fff entry_point = 0x71ef0000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2239 start_va = 0x5fb40000 end_va = 0x5fb70fff entry_point = 0x5fb40000 region_type = mapped_file name = "wbemdisp.dll" filename = "\\Windows\\System32\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemdisp.dll") Region: id = 2240 start_va = 0x75990000 end_va = 0x759eefff entry_point = 0x75990000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2241 start_va = 0xcd0000 end_va = 0xcdefff entry_point = 0xcd0000 region_type = mapped_file name = "wbemdisp.tlb" filename = "\\Windows\\System32\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\system32\\wbem\\wbemdisp.tlb") Region: id = 2243 start_va = 0xf00000 end_va = 0xf14fff entry_point = 0xf00000 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\assembly\\gac_32\\custommarshalers\\2.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 2244 start_va = 0xf20000 end_va = 0xf34fff entry_point = 0xf20000 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\assembly\\gac_32\\custommarshalers\\2.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 2245 start_va = 0xf40000 end_va = 0xf40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f40000" filename = "" Region: id = 2246 start_va = 0x5fb00000 end_va = 0x5fb39fff entry_point = 0x5fb00000 region_type = mapped_file name = "custommarshalers.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\CustomMarshalers\\bf7e7494e75e32979c7824a07570a8a9\\CustomMarshalers.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\custommarshalers\\bf7e7494e75e32979c7824a07570a8a9\\custommarshalers.ni.dll") Region: id = 2271 start_va = 0xf50000 end_va = 0xf5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 2441 start_va = 0xf60000 end_va = 0xf62fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f60000" filename = "" Region: id = 2442 start_va = 0xf60000 end_va = 0xf63fff entry_point = 0xf60000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 2443 start_va = 0x73b0000 end_va = 0x74affff entry_point = 0x0 region_type = private name = "private_0x00000000073b0000" filename = "" Region: id = 2444 start_va = 0x7500000 end_va = 0x750ffff entry_point = 0x0 region_type = private name = "private_0x0000000007500000" filename = "" Region: id = 2445 start_va = 0x7ffd3000 end_va = 0x7ffd3fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd3000" filename = "" Region: id = 2512 start_va = 0x6270000 end_va = 0x627efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006270000" filename = "" Region: id = 2513 start_va = 0x62e0000 end_va = 0x631ffff entry_point = 0x0 region_type = private name = "private_0x00000000062e0000" filename = "" Region: id = 2514 start_va = 0x6c340000 end_va = 0x6c353fff entry_point = 0x6c340000 region_type = mapped_file name = "devenum.dll" filename = "\\Windows\\System32\\devenum.dll" (normalized: "c:\\windows\\system32\\devenum.dll") Region: id = 2522 start_va = 0x70e70000 end_va = 0x70ea1fff entry_point = 0x70e70000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 2523 start_va = 0x77410000 end_va = 0x775acfff entry_point = 0x77410000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2524 start_va = 0x75c70000 end_va = 0x75c96fff entry_point = 0x75c70000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2525 start_va = 0x75c00000 end_va = 0x75c11fff entry_point = 0x75c00000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2526 start_va = 0x748a0000 end_va = 0x748c0fff entry_point = 0x748a0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2527 start_va = 0x77890000 end_va = 0x778d4fff entry_point = 0x77890000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2528 start_va = 0x75bd0000 end_va = 0x75bfcfff entry_point = 0x75bd0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2529 start_va = 0x75ab0000 end_va = 0x75bccfff entry_point = 0x75ab0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2530 start_va = 0x75aa0000 end_va = 0x75aabfff entry_point = 0x75aa0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2531 start_va = 0x74bc0000 end_va = 0x74bcafff entry_point = 0x74bc0000 region_type = mapped_file name = "msdmo.dll" filename = "\\Windows\\System32\\msdmo.dll" (normalized: "c:\\windows\\system32\\msdmo.dll") Region: id = 2532 start_va = 0x74c00000 end_va = 0x74c12fff entry_point = 0x74c00000 region_type = mapped_file name = "avicap32.dll" filename = "\\Windows\\System32\\avicap32.dll" (normalized: "c:\\windows\\system32\\avicap32.dll") Region: id = 2534 start_va = 0x6ebe0000 end_va = 0x6ec00fff entry_point = 0x6ebe0000 region_type = mapped_file name = "msvfw32.dll" filename = "\\Windows\\System32\\msvfw32.dll" (normalized: "c:\\windows\\system32\\msvfw32.dll") Region: id = 2535 start_va = 0x69830000 end_va = 0x698b3fff entry_point = 0x69830000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 2536 start_va = 0x76b0000 end_va = 0x78affff entry_point = 0x0 region_type = private name = "private_0x00000000076b0000" filename = "" Region: id = 2537 start_va = 0x6280000 end_va = 0x6281fff entry_point = 0x6280000 region_type = mapped_file name = "msvfw32.dll.mui" filename = "\\Windows\\System32\\en-US\\msvfw32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msvfw32.dll.mui") Region: id = 2538 start_va = 0x6290000 end_va = 0x6291fff entry_point = 0x6290000 region_type = mapped_file name = "avicap32.dll.mui" filename = "\\Windows\\System32\\en-US\\avicap32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\avicap32.dll.mui") Region: id = 2539 start_va = 0x65b0000 end_va = 0x662ffff entry_point = 0x0 region_type = private name = "private_0x00000000065b0000" filename = "" Region: id = 2540 start_va = 0x74c10000 end_va = 0x74c14fff entry_point = 0x74c10000 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\System32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll") Region: id = 2541 start_va = 0x62a0000 end_va = 0x62affff entry_point = 0x0 region_type = private name = "private_0x00000000062a0000" filename = "" Region: id = 2542 start_va = 0x62b0000 end_va = 0x62bffff entry_point = 0x0 region_type = private name = "private_0x00000000062b0000" filename = "" Region: id = 2543 start_va = 0x73f0000 end_va = 0x74effff entry_point = 0x0 region_type = private name = "private_0x00000000073f0000" filename = "" Region: id = 2544 start_va = 0x7510000 end_va = 0x760ffff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 2545 start_va = 0x76a0000 end_va = 0x76affff entry_point = 0x0 region_type = private name = "private_0x00000000076a0000" filename = "" Region: id = 2546 start_va = 0x76f0000 end_va = 0x77effff entry_point = 0x0 region_type = private name = "private_0x00000000076f0000" filename = "" Region: id = 2547 start_va = 0x7ff4e000 end_va = 0x7ff4efff entry_point = 0x0 region_type = private name = "private_0x000000007ff4e000" filename = "" Region: id = 2548 start_va = 0x7ff4f000 end_va = 0x7ff4ffff entry_point = 0x0 region_type = private name = "private_0x000000007ff4f000" filename = "" Region: id = 2549 start_va = 0x7ffd3000 end_va = 0x7ffd3fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd3000" filename = "" Region: id = 2550 start_va = 0x6fc0000 end_va = 0x70bffff entry_point = 0x0 region_type = private name = "private_0x0000000006fc0000" filename = "" Region: id = 2551 start_va = 0x7110000 end_va = 0x714ffff entry_point = 0x0 region_type = private name = "private_0x0000000007110000" filename = "" Region: id = 2552 start_va = 0x7830000 end_va = 0x792ffff entry_point = 0x0 region_type = private name = "private_0x0000000007830000" filename = "" Region: id = 2553 start_va = 0x7980000 end_va = 0x7a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000007980000" filename = "" Region: id = 2554 start_va = 0x7b00000 end_va = 0x7bfffff entry_point = 0x0 region_type = private name = "private_0x0000000007b00000" filename = "" Region: id = 2555 start_va = 0x7d10000 end_va = 0x7e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 2556 start_va = 0x7ff49000 end_va = 0x7ff49fff entry_point = 0x0 region_type = private name = "private_0x000000007ff49000" filename = "" Region: id = 2557 start_va = 0x7ff4a000 end_va = 0x7ff4afff entry_point = 0x0 region_type = private name = "private_0x000000007ff4a000" filename = "" Region: id = 2558 start_va = 0x7ff4b000 end_va = 0x7ff4bfff entry_point = 0x0 region_type = private name = "private_0x000000007ff4b000" filename = "" Region: id = 2559 start_va = 0x7ff4c000 end_va = 0x7ff4cfff entry_point = 0x0 region_type = private name = "private_0x000000007ff4c000" filename = "" Region: id = 2560 start_va = 0x7ff4d000 end_va = 0x7ff4dfff entry_point = 0x0 region_type = private name = "private_0x000000007ff4d000" filename = "" Region: id = 2561 start_va = 0x6280000 end_va = 0x628ffff entry_point = 0x0 region_type = private name = "private_0x0000000006280000" filename = "" Region: id = 2562 start_va = 0x7e20000 end_va = 0x7f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000007e20000" filename = "" Region: id = 2563 start_va = 0x7ff48000 end_va = 0x7ff48fff entry_point = 0x0 region_type = private name = "private_0x000000007ff48000" filename = "" Region: id = 2647 start_va = 0x7930000 end_va = 0x7a2ffff entry_point = 0x0 region_type = private name = "private_0x0000000007930000" filename = "" Region: id = 2648 start_va = 0x7c00000 end_va = 0x7cfffff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 2649 start_va = 0x7fb0000 end_va = 0x80affff entry_point = 0x0 region_type = private name = "private_0x0000000007fb0000" filename = "" Region: id = 2650 start_va = 0x7ff4c000 end_va = 0x7ff4cfff entry_point = 0x0 region_type = private name = "private_0x000000007ff4c000" filename = "" Region: id = 2712 start_va = 0x7a30000 end_va = 0x7b2ffff entry_point = 0x0 region_type = private name = "private_0x0000000007a30000" filename = "" Region: id = 2713 start_va = 0x81f0000 end_va = 0x82effff entry_point = 0x0 region_type = private name = "private_0x00000000081f0000" filename = "" Region: id = 2714 start_va = 0x8340000 end_va = 0x843ffff entry_point = 0x0 region_type = private name = "private_0x0000000008340000" filename = "" Region: id = 2715 start_va = 0x8590000 end_va = 0x868ffff entry_point = 0x0 region_type = private name = "private_0x0000000008590000" filename = "" Region: id = 2716 start_va = 0x8780000 end_va = 0x887ffff entry_point = 0x0 region_type = private name = "private_0x0000000008780000" filename = "" Region: id = 2717 start_va = 0x6e730000 end_va = 0x6e744fff entry_point = 0x6e730000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2718 start_va = 0x6e750000 end_va = 0x6e7a1fff entry_point = 0x6e750000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2719 start_va = 0x7ff44000 end_va = 0x7ff44fff entry_point = 0x0 region_type = private name = "private_0x000000007ff44000" filename = "" Region: id = 2720 start_va = 0x7ff45000 end_va = 0x7ff45fff entry_point = 0x0 region_type = private name = "private_0x000000007ff45000" filename = "" Region: id = 2721 start_va = 0x7ff46000 end_va = 0x7ff46fff entry_point = 0x0 region_type = private name = "private_0x000000007ff46000" filename = "" Region: id = 2722 start_va = 0x7ff47000 end_va = 0x7ff47fff entry_point = 0x0 region_type = private name = "private_0x000000007ff47000" filename = "" Region: id = 2723 start_va = 0x739f0000 end_va = 0x739fcfff entry_point = 0x739f0000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2724 start_va = 0x8990000 end_va = 0x8a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000008990000" filename = "" Region: id = 2725 start_va = 0x72140000 end_va = 0x7218efff entry_point = 0x72140000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2726 start_va = 0x72190000 end_va = 0x721e7fff entry_point = 0x72190000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2727 start_va = 0x7ff43000 end_va = 0x7ff43fff entry_point = 0x0 region_type = private name = "private_0x000000007ff43000" filename = "" Region: id = 2728 start_va = 0x80b0000 end_va = 0x81affff entry_point = 0x0 region_type = private name = "private_0x00000000080b0000" filename = "" Region: id = 2729 start_va = 0x751d0000 end_va = 0x751d7fff entry_point = 0x751d0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2730 start_va = 0x6280000 end_va = 0x6290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006280000" filename = "" Region: id = 2731 start_va = 0x8bd0000 end_va = 0x8ccffff entry_point = 0x0 region_type = private name = "private_0x0000000008bd0000" filename = "" Region: id = 2732 start_va = 0x7ff42000 end_va = 0x7ff42fff entry_point = 0x0 region_type = private name = "private_0x000000007ff42000" filename = "" Region: id = 2737 start_va = 0x73dc0000 end_va = 0x73dc2fff entry_point = 0x73dc0000 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 2738 start_va = 0x75940000 end_va = 0x75947fff entry_point = 0x75940000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2739 start_va = 0x75310000 end_va = 0x75349fff entry_point = 0x75310000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2740 start_va = 0x75650000 end_va = 0x75687fff entry_point = 0x75650000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2741 start_va = 0x75630000 end_va = 0x75646fff entry_point = 0x75630000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2742 start_va = 0x751e0000 end_va = 0x7521cfff entry_point = 0x751e0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2743 start_va = 0x8d80000 end_va = 0x8e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000008d80000" filename = "" Region: id = 2744 start_va = 0x750e0000 end_va = 0x750f6fff entry_point = 0x750e0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2745 start_va = 0x7ff41000 end_va = 0x7ff41fff entry_point = 0x0 region_type = private name = "private_0x000000007ff41000" filename = "" Region: id = 2746 start_va = 0x8e80000 end_va = 0x907ffff entry_point = 0x0 region_type = private name = "private_0x0000000008e80000" filename = "" Region: id = 2747 start_va = 0x750c0000 end_va = 0x750d5fff entry_point = 0x750c0000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2748 start_va = 0x6d120000 end_va = 0x6d187fff entry_point = 0x6d120000 region_type = mapped_file name = "p2pcollab.dll" filename = "\\Windows\\System32\\p2pcollab.dll" (normalized: "c:\\windows\\system32\\p2pcollab.dll") Region: id = 2753 start_va = 0x6d130000 end_va = 0x6d182fff entry_point = 0x6d130000 region_type = mapped_file name = "qagentrt.dll" filename = "\\Windows\\System32\\QAGENTRT.DLL" (normalized: "c:\\windows\\system32\\qagentrt.dll") Region: id = 2754 start_va = 0x62c0000 end_va = 0x62c3fff entry_point = 0x62c0000 region_type = mapped_file name = "dnsapi.dll.mui" filename = "\\Windows\\System32\\en-US\\dnsapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dnsapi.dll.mui") Region: id = 2757 start_va = 0x6d170000 end_va = 0x6d18dfff entry_point = 0x6d170000 region_type = mapped_file name = "fveui.dll" filename = "\\Windows\\System32\\fveui.dll" (normalized: "c:\\windows\\system32\\fveui.dll") Region: id = 2770 start_va = 0x6d070000 end_va = 0x6d08dfff entry_point = 0x6d070000 region_type = mapped_file name = "fveui.dll" filename = "\\Windows\\System32\\fveui.dll" (normalized: "c:\\windows\\system32\\fveui.dll") Region: id = 3185 start_va = 0xcd0000 end_va = 0xcd8fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cd0000" filename = "" Region: id = 3186 start_va = 0x4c30000 end_va = 0x4d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 3187 start_va = 0x72d0000 end_va = 0x73cffff entry_point = 0x0 region_type = private name = "private_0x00000000072d0000" filename = "" Region: id = 3188 start_va = 0x7ffd4000 end_va = 0x7ffd4fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd4000" filename = "" Region: id = 3189 start_va = 0xcd0000 end_va = 0xcd8fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cd0000" filename = "" Thread: id = 178 os_tid = 0x2c8 [0087.513] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0087.580] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x2fe6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0087.580] GetLastError () returned 0x2 [0087.584] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x2fe66c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0087.584] GetLastError () returned 0x2 [0087.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x2fe634, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0087.587] GetLastError () returned 0x2 [0087.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x2fe6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0087.591] GetLastError () returned 0x2 [0087.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x2fe66c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0087.591] GetLastError () returned 0x2 [0087.598] GetVersionExW (in: lpVersionInformation=0x650248*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x650248*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0087.598] GetLastError () returned 0x2 [0087.599] GetVersionExW (in: lpVersionInformation=0x650248*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x650248*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0087.599] GetLastError () returned 0x2 [0088.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x2fe774, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0088.034] GetLastError () returned 0x0 [0088.034] GetVersionExW (in: lpVersionInformation=0x650cf0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x650cf0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0088.034] GetLastError () returned 0x0 [0088.035] SetErrorMode (uMode=0x1) returned 0x0 [0088.036] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x2fec1c | out: lpFileInformation=0x2fec1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb6bee9, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cb6bee9, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xaa818efc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xb5)) returned 1 [0088.036] GetLastError () returned 0x0 [0088.036] SetErrorMode (uMode=0x0) returned 0x1 [0089.963] VirtualProtect (in: lpAddress=0x3b80178, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x34a) returned 0 [0089.979] VirtualProtect (in: lpAddress=0x3b801a0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x82a592eb) returned 0 [0089.979] VirtualProtect (in: lpAddress=0x3b801c8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x82a592eb) returned 0 [0089.984] VirtualProtect (in: lpAddress=0x3c27d2e, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x82a592eb) returned 0 [0089.999] VirtualProtect (in: lpAddress=0x3c27d22, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x82a592eb) returned 0 [0090.004] VirtualProtect (in: lpAddress=0x3b80208, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x82a592eb) returned 0 [0090.006] VirtualProtect (in: lpAddress=0x3bd8678, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x82a592eb) returned 0 [0090.006] VirtualProtect (in: lpAddress=0x3bd869c, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x82a592eb) returned 0 [0090.006] VirtualProtect (in: lpAddress=0x3bd86a4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x82a592eb) returned 0 [0090.006] VirtualProtect (in: lpAddress=0x3bd86a8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x82a592eb) returned 0 [0090.006] VirtualProtect (in: lpAddress=0x3bd86b0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x82a592eb) returned 0 [0090.006] VirtualProtect (in: lpAddress=0x3bd86b4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.007] VirtualProtect (in: lpAddress=0x3bd86b8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.007] VirtualProtect (in: lpAddress=0x3bd86bc, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.007] VirtualProtect (in: lpAddress=0x3bd86c4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.007] VirtualProtect (in: lpAddress=0x3bd86c8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.007] VirtualProtect (in: lpAddress=0x3bd86cc, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.007] VirtualProtect (in: lpAddress=0x3bd86d4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.007] VirtualProtect (in: lpAddress=0x3bd86d8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.007] VirtualProtect (in: lpAddress=0x3bd86dc, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.007] VirtualProtect (in: lpAddress=0x3bd86e4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.007] VirtualProtect (in: lpAddress=0x3bd86e8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.008] VirtualProtect (in: lpAddress=0x3bd86ec, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.008] VirtualProtect (in: lpAddress=0x3bd86f0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.008] VirtualProtect (in: lpAddress=0x3bd86f8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.008] VirtualProtect (in: lpAddress=0x3bd86fc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.008] VirtualProtect (in: lpAddress=0x3bd8700, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.008] VirtualProtect (in: lpAddress=0x3bd8708, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.008] VirtualProtect (in: lpAddress=0x3bd870c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x2fe158 | out: lpflOldProtect=0x2fe158*=0x0) returned 0 [0090.029] GetEnvironmentVariableW (in: lpName="COR_PROFILER", lpBuffer=0x650cd8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.029] GetLastError () returned 0xcb [0090.031] GetEnvironmentVariableW (in: lpName="COR_ENABLE_PROFILING", lpBuffer=0x650cd8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.031] GetLastError () returned 0xcb [0090.565] SetProcessDPIAware () returned 1 [0090.565] GetLastError () returned 0x0 [0090.770] GetCurrentProcess () returned 0xffffffff [0090.770] GetCurrentThread () returned 0xfffffffe [0090.770] GetCurrentProcess () returned 0xffffffff [0090.772] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x2fe7a0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x2fe7a0*=0x1b0) returned 1 [0090.772] GetLastError () returned 0x3 [0090.774] GetCurrentThreadId () returned 0x2c8 [0090.829] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="a403e9b3-6f76-41ac-ab55-e693040d1b8b") returned 0x1b4 [0090.829] GetLastError () returned 0x0 [0090.830] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x2fe74c*=0x1b4, lpdwindex=0x2fe504 | out: lpdwindex=0x2fe504) returned 0x0 [0090.900] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x2fd514 | out: pFixedInfo=0x0, pOutBufLen=0x2fd514) returned 0x6f [0090.936] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x68b750 [0090.936] GetLastError () returned 0x0 [0090.937] GetNetworkParams (in: pFixedInfo=0x68b750, pOutBufLen=0x2fd514 | out: pFixedInfo=0x68b750, pOutBufLen=0x2fd514) returned 0x0 [0090.960] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x68b9a8 | out: lpWSAData=0x68b9a8) returned 0 [0090.964] GetLastError () returned 0x0 [0090.972] lstrlenW (lpString="䅁") returned 1 [0090.974] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x2fcb8c | out: phkResult=0x2fcb8c*=0x24c) returned 0x0 [0090.975] RegQueryValueExW (in: hKey=0x24c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x2fcbd4, lpData=0x0, lpcbData=0x2fcbd0*=0x0 | out: lpType=0x2fcbd4*=0x1, lpData=0x0, lpcbData=0x2fcbd0*=0xe) returned 0x0 [0090.976] RegQueryValueExW (in: hKey=0x24c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x2fcbd4, lpData=0x650cd8, lpcbData=0x2fcbd0*=0xe | out: lpType=0x2fcbd4*=0x1, lpData="Client", lpcbData=0x2fcbd0*=0xe) returned 0x0 [0090.976] RegCloseKey (hKey=0x24c) returned 0x0 [0090.978] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x250 [0090.982] GetLastError () returned 0x0 [0090.983] setsockopt (s=0x250, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0090.983] GetLastError () returned 0x273a [0090.983] closesocket (s=0x250) returned 0 [0090.983] GetLastError () returned 0x0 [0090.983] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x250 [0090.984] GetLastError () returned 0x0 [0090.984] setsockopt (s=0x250, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0090.984] GetLastError () returned 0x273a [0090.984] closesocket (s=0x250) returned 0 [0090.985] GetLastError () returned 0x0 [0091.050] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x2fcdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0091.050] GetLastError () returned 0x0 [0091.050] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x2fcda4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0091.050] GetLastError () returned 0x0 [0091.051] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x2fcda8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0091.051] GetLastError () returned 0x0 [0091.180] GetVersionExW (in: lpVersionInformation=0x650cf0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x650cf0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0091.180] GetLastError () returned 0x0 [0091.181] GetCurrentProcess () returned 0xffffffff [0091.181] GetLastError () returned 0x3f0 [0091.182] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fcf3c | out: TokenHandle=0x2fcf3c*=0x250) returned 1 [0091.182] GetLastError () returned 0x3f0 [0091.185] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x2fcad4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0091.185] GetLastError () returned 0x0 [0091.188] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x2fcf7c | out: lpFileInformation=0x2fcf7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e385d07, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8e385d07, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0x7da1e096, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0091.188] GetLastError () returned 0x0 [0091.189] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x2fca94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0091.189] GetLastError () returned 0x0 [0091.190] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x2fcf78 | out: lpFileInformation=0x2fcf78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e385d07, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8e385d07, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0x7da1e096, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0091.190] GetLastError () returned 0x0 [0091.191] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x2fc9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0091.191] GetLastError () returned 0x0 [0091.191] SetErrorMode (uMode=0x1) returned 0x0 [0091.193] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0091.193] GetLastError () returned 0x0 [0091.193] GetFileType (hFile=0x258) returned 0x1 [0091.193] SetErrorMode (uMode=0x0) returned 0x1 [0091.193] GetFileType (hFile=0x258) returned 0x1 [0091.202] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x2fcf4c | out: lpFileSizeHigh=0x2fcf4c*=0x0) returned 0x65b3 [0091.202] GetLastError () returned 0x0 [0091.203] ReadFile (in: hFile=0x258, lpBuffer=0x1bdde80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2fcf04, lpOverlapped=0x0 | out: lpBuffer=0x1bdde80*, lpNumberOfBytesRead=0x2fcf04*=0x1000, lpOverlapped=0x0) returned 1 [0091.204] GetLastError () returned 0x0 [0091.213] ReadFile (in: hFile=0x258, lpBuffer=0x1bdde80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2fcd14, lpOverlapped=0x0 | out: lpBuffer=0x1bdde80*, lpNumberOfBytesRead=0x2fcd14*=0x1000, lpOverlapped=0x0) returned 1 [0091.213] GetLastError () returned 0x0 [0091.214] ReadFile (in: hFile=0x258, lpBuffer=0x1bdde80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2fcbbc, lpOverlapped=0x0 | out: lpBuffer=0x1bdde80*, lpNumberOfBytesRead=0x2fcbbc*=0x1000, lpOverlapped=0x0) returned 1 [0091.214] GetLastError () returned 0x0 [0091.214] ReadFile (in: hFile=0x258, lpBuffer=0x1bdde80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2fcbbc, lpOverlapped=0x0 | out: lpBuffer=0x1bdde80*, lpNumberOfBytesRead=0x2fcbbc*=0x1000, lpOverlapped=0x0) returned 1 [0091.214] GetLastError () returned 0x0 [0091.214] ReadFile (in: hFile=0x258, lpBuffer=0x1bdde80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2fcbbc, lpOverlapped=0x0 | out: lpBuffer=0x1bdde80*, lpNumberOfBytesRead=0x2fcbbc*=0x1000, lpOverlapped=0x0) returned 1 [0091.214] GetLastError () returned 0x0 [0091.218] ReadFile (in: hFile=0x258, lpBuffer=0x1bdde80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2fccf0, lpOverlapped=0x0 | out: lpBuffer=0x1bdde80*, lpNumberOfBytesRead=0x2fccf0*=0x1000, lpOverlapped=0x0) returned 1 [0091.218] GetLastError () returned 0x0 [0091.218] ReadFile (in: hFile=0x258, lpBuffer=0x1bdde80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2fcb84, lpOverlapped=0x0 | out: lpBuffer=0x1bdde80*, lpNumberOfBytesRead=0x2fcb84*=0x5b3, lpOverlapped=0x0) returned 1 [0091.218] GetLastError () returned 0x0 [0091.218] ReadFile (in: hFile=0x258, lpBuffer=0x1bdde80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2fcc70, lpOverlapped=0x0 | out: lpBuffer=0x1bdde80*, lpNumberOfBytesRead=0x2fcc70*=0x0, lpOverlapped=0x0) returned 1 [0091.218] GetLastError () returned 0x0 [0091.218] CloseHandle (hObject=0x258) returned 1 [0091.219] GetLastError () returned 0x0 [0091.219] GetCurrentProcess () returned 0xffffffff [0091.219] GetLastError () returned 0x3f0 [0091.220] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fd1cc | out: TokenHandle=0x2fd1cc*=0x258) returned 1 [0091.220] GetLastError () returned 0x3f0 [0091.220] GetCurrentProcess () returned 0xffffffff [0091.220] GetLastError () returned 0x3f0 [0091.220] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fd1cc | out: TokenHandle=0x2fd1cc*=0x254) returned 1 [0091.220] GetLastError () returned 0x3f0 [0091.221] GetCurrentProcess () returned 0xffffffff [0091.221] GetLastError () returned 0x3f0 [0091.221] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fcf3c | out: TokenHandle=0x2fcf3c*=0x25c) returned 1 [0091.221] GetLastError () returned 0x3f0 [0091.221] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x2fcf7c | out: lpFileInformation=0x2fcf7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb6bee9, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cb6bee9, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xaa818efc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xb5)) returned 1 [0091.221] GetLastError () returned 0x3f0 [0091.221] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x2fca94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0091.221] GetLastError () returned 0x3f0 [0091.221] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x2fcf78 | out: lpFileInformation=0x2fcf78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb6bee9, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cb6bee9, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xaa818efc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xb5)) returned 1 [0091.221] GetLastError () returned 0x3f0 [0091.221] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x2fc9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0091.221] GetLastError () returned 0x3f0 [0091.221] SetErrorMode (uMode=0x1) returned 0x0 [0091.221] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0091.222] GetLastError () returned 0x0 [0091.222] GetFileType (hFile=0x260) returned 0x1 [0091.222] SetErrorMode (uMode=0x0) returned 0x1 [0091.222] GetFileType (hFile=0x260) returned 0x1 [0091.222] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x2fcf4c | out: lpFileSizeHigh=0x2fcf4c*=0x0) returned 0xb5 [0091.222] GetLastError () returned 0x0 [0091.222] ReadFile (in: hFile=0x260, lpBuffer=0x1bf42d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2fcf04, lpOverlapped=0x0 | out: lpBuffer=0x1bf42d8*, lpNumberOfBytesRead=0x2fcf04*=0xb5, lpOverlapped=0x0) returned 1 [0091.223] GetLastError () returned 0x0 [0091.225] ReadFile (in: hFile=0x260, lpBuffer=0x1bf42d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2fcda8, lpOverlapped=0x0 | out: lpBuffer=0x1bf42d8*, lpNumberOfBytesRead=0x2fcda8*=0x0, lpOverlapped=0x0) returned 1 [0091.225] GetLastError () returned 0x0 [0091.225] CloseHandle (hObject=0x260) returned 1 [0091.225] GetLastError () returned 0x0 [0091.225] GetCurrentProcess () returned 0xffffffff [0091.225] GetLastError () returned 0x3f0 [0091.225] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fd1cc | out: TokenHandle=0x2fd1cc*=0x260) returned 1 [0091.225] GetLastError () returned 0x3f0 [0091.225] GetCurrentProcess () returned 0xffffffff [0091.225] GetLastError () returned 0x3f0 [0091.225] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fd1cc | out: TokenHandle=0x2fd1cc*=0x264) returned 1 [0091.226] GetLastError () returned 0x3f0 [0091.243] lstrlenW (lpString="䅁") returned 1 [0091.245] GetCurrentProcess () returned 0xffffffff [0091.245] GetLastError () returned 0x3f0 [0091.245] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fcfa8 | out: TokenHandle=0x2fcfa8*=0x268) returned 1 [0091.245] GetLastError () returned 0x3f0 [0091.252] GetCurrentProcess () returned 0xffffffff [0091.252] GetLastError () returned 0x3f0 [0091.252] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fcfb8 | out: TokenHandle=0x2fcfb8*=0x26c) returned 1 [0091.252] GetLastError () returned 0x3f0 [0091.262] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x2fcdb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0091.262] GetLastError () returned 0x3f0 [0091.265] GetCurrentProcessId () returned 0x24c [0091.267] GetComputerNameW (in: lpBuffer=0x68b9a8, nSize=0x1bfa8dc | out: lpBuffer="ARRARNMKU", nSize=0x1bfa8dc) returned 1 [0091.268] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.NET CLR Networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x2fd20c | out: phkResult=0x2fd20c*=0x270) returned 0x0 [0091.268] RegQueryValueExW (in: hKey=0x270, lpValueName="Library", lpReserved=0x0, lpType=0x2fd254, lpData=0x0, lpcbData=0x2fd250*=0x0 | out: lpType=0x2fd254*=0x1, lpData=0x0, lpcbData=0x2fd250*=0x1c) returned 0x0 [0091.268] RegQueryValueExW (in: hKey=0x270, lpValueName="Library", lpReserved=0x0, lpType=0x2fd254, lpData=0x650cd8, lpcbData=0x2fd250*=0x1c | out: lpType=0x2fd254*=0x1, lpData="netfxperf.dll", lpcbData=0x2fd250*=0x1c) returned 0x0 [0091.269] RegQueryValueExW (in: hKey=0x270, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x2fd254, lpData=0x0, lpcbData=0x2fd250*=0x0 | out: lpType=0x2fd254*=0x4, lpData=0x0, lpcbData=0x2fd250*=0x4) returned 0x0 [0091.269] RegQueryValueExW (in: hKey=0x270, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x2fd254, lpData=0x2fd240, lpcbData=0x2fd250*=0x4 | out: lpType=0x2fd254*=0x4, lpData=0x2fd240*=0x1, lpcbData=0x2fd250*=0x4) returned 0x0 [0091.269] RegQueryValueExW (in: hKey=0x270, lpValueName="First Counter", lpReserved=0x0, lpType=0x2fd254, lpData=0x0, lpcbData=0x2fd250*=0x0 | out: lpType=0x2fd254*=0x4, lpData=0x0, lpcbData=0x2fd250*=0x4) returned 0x0 [0091.269] RegQueryValueExW (in: hKey=0x270, lpValueName="First Counter", lpReserved=0x0, lpType=0x2fd254, lpData=0x2fd240, lpcbData=0x2fd250*=0x4 | out: lpType=0x2fd254*=0x4, lpData=0x2fd240*=0x1040, lpcbData=0x2fd250*=0x4) returned 0x0 [0091.269] RegCloseKey (hKey=0x270) returned 0x0 [0091.271] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.net clr networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x2fd208 | out: phkResult=0x2fd208*=0x270) returned 0x0 [0091.271] RegQueryValueExW (in: hKey=0x270, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x2fd250, lpData=0x0, lpcbData=0x2fd24c*=0x0 | out: lpType=0x2fd250*=0x4, lpData=0x0, lpcbData=0x2fd24c*=0x4) returned 0x0 [0091.271] RegQueryValueExW (in: hKey=0x270, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x2fd250, lpData=0x2fd23c, lpcbData=0x2fd24c*=0x4 | out: lpType=0x2fd250*=0x4, lpData=0x2fd23c*=0x3, lpcbData=0x2fd24c*=0x4) returned 0x0 [0091.271] RegQueryValueExW (in: hKey=0x270, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x2fd250, lpData=0x0, lpcbData=0x2fd24c*=0x0 | out: lpType=0x2fd250*=0x4, lpData=0x0, lpcbData=0x2fd24c*=0x4) returned 0x0 [0091.271] RegQueryValueExW (in: hKey=0x270, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x2fd250, lpData=0x2fd23c, lpcbData=0x2fd24c*=0x4 | out: lpType=0x2fd250*=0x4, lpData=0x2fd23c*=0x20000, lpcbData=0x2fd24c*=0x4) returned 0x0 [0091.272] RegQueryValueExW (in: hKey=0x270, lpValueName="Counter Names", lpReserved=0x0, lpType=0x2fd250, lpData=0x0, lpcbData=0x2fd24c*=0x0 | out: lpType=0x2fd250*=0x3, lpData=0x0, lpcbData=0x2fd24c*=0xaa) returned 0x0 [0091.272] RegQueryValueExW (in: hKey=0x270, lpValueName="Counter Names", lpReserved=0x0, lpType=0x2fd250, lpData=0x1bfd028, lpcbData=0x2fd24c*=0xaa | out: lpType=0x2fd250*=0x3, lpData=0x1bfd028*, lpcbData=0x2fd24c*=0xaa) returned 0x0 [0091.274] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0091.275] GetLastError () returned 0x0 [0091.277] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x650d08, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20000, lpName="Global\\netfxcustomperfcounters.1.0.net clr networking") returned 0x278 [0091.277] GetLastError () returned 0x0 [0091.279] MapViewOfFile (hFileMappingObject=0x278, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x790000 [0091.280] VirtualQuery (in: lpAddress=0x790000, lpBuffer=0x2fd220, dwLength=0x1c | out: lpBuffer=0x2fd220*(BaseAddress=0x790000, AllocationBase=0x790000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x40000)) returned 0x1c [0091.280] GetLastError () returned 0x0 [0091.280] LocalFree (hMem=0x6851f8) returned 0x0 [0091.280] RegCloseKey (hKey=0x270) returned 0x0 [0091.283] GetVersionExW (in: lpVersionInformation=0x650cf0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x650cf0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0091.283] GetLastError () returned 0x0 [0091.283] GetVersionExW (in: lpVersionInformation=0x650cf0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x650cf0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0091.283] GetLastError () returned 0x0 [0091.284] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1bfdad0, cbSid=0x2fd200 | out: pSid=0x1bfdad0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd200) returned 1 [0091.284] GetLastError () returned 0x0 [0091.285] CreateMutexW (lpMutexAttributes=0x1bfdc20, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x270 [0091.285] GetLastError () returned 0x0 [0091.287] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x1f4) returned 0x0 [0091.287] GetLastError () returned 0x0 [0091.287] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1bfddf4, cbSid=0x2fd1c0 | out: pSid=0x1bfddf4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd1c0) returned 1 [0091.287] GetLastError () returned 0x0 [0091.288] CreateMutexW (lpMutexAttributes=0x1bfdf04, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x0 [0091.288] GetLastError () returned 0x5 [0091.288] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="Global\\.net clr networking") returned 0x27c [0091.289] GetLastError () returned 0x5 [0091.289] CloseHandle (hObject=0x27c) returned 1 [0091.289] GetLastError () returned 0x5 [0091.289] GetCurrentProcessId () returned 0x24c [0091.290] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x24c) returned 0x27c [0091.290] GetLastError () returned 0x5 [0091.291] GetProcessTimes (in: hProcess=0x27c, lpCreationTime=0x2fd1c4, lpExitTime=0x2fd1bc, lpKernelTime=0x2fd1bc, lpUserTime=0x2fd1bc | out: lpCreationTime=0x2fd1c4, lpExitTime=0x2fd1bc, lpKernelTime=0x2fd1bc, lpUserTime=0x2fd1bc) returned 1 [0091.291] GetLastError () returned 0x5 [0091.291] CloseHandle (hObject=0x27c) returned 1 [0091.291] GetLastError () returned 0x5 [0091.291] CloseHandle (hObject=0x270) returned 1 [0091.291] GetLastError () returned 0x5 [0091.291] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1bfe7f0, cbSid=0x2fd200 | out: pSid=0x1bfe7f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd200) returned 1 [0091.291] GetLastError () returned 0x5 [0091.292] CreateMutexW (lpMutexAttributes=0x1bfe900, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x270 [0091.292] GetLastError () returned 0x0 [0091.295] ReleaseMutex (hMutex=0x270) returned 1 [0091.295] GetLastError () returned 0x0 [0091.295] CloseHandle (hObject=0x270) returned 1 [0091.295] GetLastError () returned 0x0 [0091.295] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1bff1c4, cbSid=0x2fd200 | out: pSid=0x1bff1c4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd200) returned 1 [0091.295] GetLastError () returned 0x0 [0091.296] CreateMutexW (lpMutexAttributes=0x1bff2d4, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x270 [0091.296] GetLastError () returned 0x0 [0091.296] CloseHandle (hObject=0x270) returned 1 [0091.296] GetLastError () returned 0x0 [0091.296] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1bffa50, cbSid=0x2fd200 | out: pSid=0x1bffa50*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd200) returned 1 [0091.296] GetLastError () returned 0x0 [0091.296] CreateMutexW (lpMutexAttributes=0x1bffb60, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x270 [0091.296] GetLastError () returned 0x0 [0091.297] CloseHandle (hObject=0x270) returned 1 [0091.297] GetLastError () returned 0x0 [0091.297] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1c002d4, cbSid=0x2fd200 | out: pSid=0x1c002d4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd200) returned 1 [0091.297] GetLastError () returned 0x0 [0091.297] CreateMutexW (lpMutexAttributes=0x1c003e4, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x270 [0091.297] GetLastError () returned 0x0 [0091.297] CloseHandle (hObject=0x270) returned 1 [0091.297] GetLastError () returned 0x0 [0091.297] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1c00b60, cbSid=0x2fd1f8 | out: pSid=0x1c00b60*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd1f8) returned 1 [0091.297] GetLastError () returned 0x0 [0091.298] CreateMutexW (lpMutexAttributes=0x1c00c70, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x270 [0091.298] GetLastError () returned 0x0 [0091.298] CloseHandle (hObject=0x270) returned 1 [0091.298] GetLastError () returned 0x0 [0091.298] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1c013f8, cbSid=0x2fd1f8 | out: pSid=0x1c013f8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd1f8) returned 1 [0091.298] GetLastError () returned 0x0 [0091.298] CreateMutexW (lpMutexAttributes=0x1c01508, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x270 [0091.298] GetLastError () returned 0x0 [0091.299] CloseHandle (hObject=0x270) returned 1 [0091.299] GetLastError () returned 0x0 [0091.299] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1c01c6c, cbSid=0x2fd1f8 | out: pSid=0x1c01c6c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd1f8) returned 1 [0091.299] GetLastError () returned 0x0 [0091.299] CreateMutexW (lpMutexAttributes=0x1c01d7c, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x270 [0091.299] GetLastError () returned 0x0 [0091.299] CloseHandle (hObject=0x270) returned 1 [0091.299] GetLastError () returned 0x0 [0091.300] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1c024f0, cbSid=0x2fd1f8 | out: pSid=0x1c024f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd1f8) returned 1 [0091.300] GetLastError () returned 0x0 [0091.300] CreateMutexW (lpMutexAttributes=0x1c02600, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x270 [0091.300] GetLastError () returned 0x0 [0091.300] CloseHandle (hObject=0x270) returned 1 [0091.300] GetLastError () returned 0x0 [0091.300] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x1c02d6c, cbSid=0x2fd1f8 | out: pSid=0x1c02d6c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x2fd1f8) returned 1 [0091.300] GetLastError () returned 0x0 [0091.300] CreateMutexW (lpMutexAttributes=0x1c02e7c, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x270 [0091.300] GetLastError () returned 0x0 [0091.301] CloseHandle (hObject=0x270) returned 1 [0091.301] GetLastError () returned 0x0 [0091.304] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0091.304] GetLastError () returned 0x0 [0091.306] LocalFree (hMem=0x68b750) returned 0x0 [0091.306] GetLastError () returned 0x0 [0091.419] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x270 [0091.419] GetLastError () returned 0x0 [0091.421] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x27c [0091.421] GetLastError () returned 0x0 [0091.429] SetEvent (hEvent=0x27c) returned 1 [0091.429] GetLastError () returned 0x0 [0091.429] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2fe64c*=0x270, lpdwindex=0x2fe404 | out: lpdwindex=0x2fe404) returned 0x0 [0091.481] CoGetContextToken (in: pToken=0x2fe49c | out: pToken=0x2fe49c) returned 0x0 [0091.481] CoGetContextToken (in: pToken=0x2fe45c | out: pToken=0x2fe45c) returned 0x0 [0091.482] WbemDefPath:IUnknown:AddRef (This=0x7110820) returned 0x2 [0091.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110820, riid=0x2fe4d8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe4d4 | out: ppvObject=0x2fe4d4*=0x7110820) returned 0x0 [0091.482] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x2 [0091.482] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x1 [0091.482] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c8 [0091.482] GetLastError () returned 0x0 [0091.482] SetEvent (hEvent=0x27c) returned 1 [0091.483] GetLastError () returned 0x0 [0091.483] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2fde70*=0x2c8, lpdwindex=0x2fdc28 | out: lpdwindex=0x2fdc28) returned 0x0 [0091.485] CoGetContextToken (in: pToken=0x2fdcc0 | out: pToken=0x2fdcc0) returned 0x0 [0091.485] CoGetContextToken (in: pToken=0x2fdc80 | out: pToken=0x2fdc80) returned 0x0 [0091.485] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x2 [0091.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fdcfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fdcf8 | out: ppvObject=0x2fdcf8*=0x71108b8) returned 0x0 [0091.485] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.485] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x1 [0091.489] CoGetContextToken (in: pToken=0x2fdd40 | out: pToken=0x2fdd40) returned 0x0 [0091.489] CoGetContextToken (in: pToken=0x2fdd00 | out: pToken=0x2fdd00) returned 0x0 [0091.489] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x2 [0091.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fdd7c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fdd78 | out: ppvObject=0x2fdd78*=0x71108b8) returned 0x0 [0091.490] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.490] WbemDefPath:IWbemPath:SetText (This=0x71108b8, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0091.490] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x1 [0091.490] CoGetContextToken (in: pToken=0x2fe51c | out: pToken=0x2fe51c) returned 0x0 [0091.490] CoGetContextToken (in: pToken=0x2fe4dc | out: pToken=0x2fe4dc) returned 0x0 [0091.490] WbemDefPath:IUnknown:AddRef (This=0x7110820) returned 0x2 [0091.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110820, riid=0x2fe558*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe554 | out: ppvObject=0x2fe554*=0x7110820) returned 0x0 [0091.490] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x2 [0091.490] WbemDefPath:IWbemPath:SetText (This=0x7110820, uMode=0x4, pszPath="Win32_OperatingSystem") returned 0x0 [0091.490] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x1 [0091.492] CoGetContextToken (in: pToken=0x2fe538 | out: pToken=0x2fe538) returned 0x0 [0091.492] CoGetContextToken (in: pToken=0x2fe4f8 | out: pToken=0x2fe4f8) returned 0x0 [0091.492] WbemDefPath:IUnknown:AddRef (This=0x7110820) returned 0x2 [0091.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110820, riid=0x2fe574*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe570 | out: ppvObject=0x2fe570*=0x7110820) returned 0x0 [0091.492] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x2 [0091.492] WbemDefPath:IWbemPath:GetInfo (in: This=0x7110820, uRequestedInfo=0x0, puResponse=0x2fe6ec | out: puResponse=0x2fe6ec*=0xc15) returned 0x0 [0091.492] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x1 [0091.493] CoGetContextToken (in: pToken=0x2fe534 | out: pToken=0x2fe534) returned 0x0 [0091.493] CoGetContextToken (in: pToken=0x2fe4f4 | out: pToken=0x2fe4f4) returned 0x0 [0091.493] WbemDefPath:IUnknown:AddRef (This=0x7110820) returned 0x2 [0091.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110820, riid=0x2fe570*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe56c | out: ppvObject=0x2fe56c*=0x7110820) returned 0x0 [0091.494] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x2 [0091.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7110820, puCount=0x2fe6e8 | out: puCount=0x2fe6e8*=0x0) returned 0x0 [0091.494] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x1 [0091.494] CoGetContextToken (in: pToken=0x2fe500 | out: pToken=0x2fe500) returned 0x0 [0091.494] CoGetContextToken (in: pToken=0x2fe4c0 | out: pToken=0x2fe4c0) returned 0x0 [0091.494] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x2 [0091.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe53c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe538 | out: ppvObject=0x2fe538*=0x71108b8) returned 0x0 [0091.494] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x71108b8, puCount=0x2fe6b4 | out: puCount=0x2fe6b4*=0x2) returned 0x0 [0091.495] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x1 [0091.496] CoGetContextToken (in: pToken=0x2fe4f0 | out: pToken=0x2fe4f0) returned 0x0 [0091.496] CoGetContextToken (in: pToken=0x2fe4b0 | out: pToken=0x2fe4b0) returned 0x0 [0091.496] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x2 [0091.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe52c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe528 | out: ppvObject=0x2fe528*=0x71108b8) returned 0x0 [0091.496] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.496] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe6b0*=0x0, pszText=0x0 | out: puBuffLength=0x2fe6b0*=0xf, pszText=0x0) returned 0x0 [0091.496] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x1 [0091.497] CoGetContextToken (in: pToken=0x2fe4f0 | out: pToken=0x2fe4f0) returned 0x0 [0091.497] CoGetContextToken (in: pToken=0x2fe4b0 | out: pToken=0x2fe4b0) returned 0x0 [0091.497] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x2 [0091.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe52c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe528 | out: ppvObject=0x2fe528*=0x71108b8) returned 0x0 [0091.497] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.497] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe6b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x2fe6b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0091.497] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x1 [0091.531] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2fe534*=0x2dc, lpdwindex=0x2fe390 | out: lpdwindex=0x2fe390) returned 0x0 [0091.809] CoGetContextToken (in: pToken=0x2fe580 | out: pToken=0x2fe580) returned 0x0 [0091.809] CoGetContextToken (in: pToken=0x2fe52c | out: pToken=0x2fe52c) returned 0x0 [0091.809] IUnknown:QueryInterface (in: This=0x648630, riid=0x6267beb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe500 | out: ppvObject=0x2fe500*=0x648640) returned 0x0 [0091.809] CObjectContext::ContextCallback () returned 0x0 [0091.815] IUnknown:Release (This=0x648640) returned 0x1 [0091.815] CoUnmarshalInterface (in: pStm=0x6969d8, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x2fe584 | out: ppv=0x2fe584*=0x6a63ac) returned 0x0 [0091.816] CoMarshalInterface (pStm=0x6969d8, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x6a63ac, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0091.816] WbemLocator:IUnknown:QueryInterface (in: This=0x6a63ac, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe1a4 | out: ppvObject=0x2fe1a4*=0x6a63ac) returned 0x0 [0091.817] WbemLocator:IUnknown:QueryInterface (in: This=0x6a63ac, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fe160 | out: ppvObject=0x2fe160*=0x0) returned 0x80004002 [0091.817] WbemLocator:IUnknown:QueryInterface (in: This=0x6a63ac, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fe054 | out: ppvObject=0x2fe054*=0x0) returned 0x80004002 [0091.817] WbemLocator:IUnknown:AddRef (This=0x6a63ac) returned 0x3 [0091.817] CoGetContextToken (in: pToken=0x2fdfec | out: pToken=0x2fdfec) returned 0x0 [0091.817] CoGetContextToken (in: pToken=0x2fdfb0 | out: pToken=0x2fdfb0) returned 0x0 [0091.818] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdfe4 | out: ppvObject=0x2fdfe4*=0x6484cc) returned 0x0 [0091.818] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fe014 | out: pAptType=0x2fe014*=3) returned 0x0 [0091.818] IUnknown:Release (This=0x6484cc) returned 0x0 [0091.818] CoGetObjectContext (in: riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x67cf0c | out: ppv=0x67cf0c*=0x6484c0) returned 0x0 [0091.818] WbemLocator:IUnknown:QueryInterface (in: This=0x6a63ac, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdfd4 | out: ppvObject=0x2fdfd4*=0x6a630c) returned 0x0 [0091.818] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6a630c, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fdfdc | out: pCid=0x2fdfdc*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0091.818] WbemLocator:IUnknown:Release (This=0x6a630c) returned 0x3 [0091.818] CoGetContextToken (in: pToken=0x2fdfe4 | out: pToken=0x2fdfe4) returned 0x0 [0091.818] WbemLocator:IUnknown:AddRef (This=0x6a63ac) returned 0x4 [0091.818] WbemLocator:IUnknown:QueryInterface (in: This=0x6a63ac, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe058 | out: ppvObject=0x2fe058*=0x6a6394) returned 0x0 [0091.818] WbemLocator:IUnknown:Release (This=0x6a63ac) returned 0x4 [0091.818] WbemLocator:IRpcOptions:Query (in: This=0x6a6394, pPrx=0x6a63ac, dwProperty=2, pdwValue=0x2fe07c | out: pdwValue=0x2fe07c) returned 0x0 [0091.818] WbemLocator:IUnknown:Release (This=0x6a6394) returned 0x3 [0091.818] WbemLocator:IUnknown:Release (This=0x6a63ac) returned 0x2 [0091.819] WbemLocator:IUnknown:Release (This=0x6a63ac) returned 0x1 [0091.819] CoGetContextToken (in: pToken=0x2fe040 | out: pToken=0x2fe040) returned 0x0 [0091.819] WbemLocator:IUnknown:AddRef (This=0x6a63ac) returned 0x2 [0091.819] WbemLocator:IUnknown:QueryInterface (in: This=0x6a63ac, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2e4 | out: ppvObject=0x2fe2e4*=0x6a638c) returned 0x0 [0091.819] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6a638c, pProxy=0x6a63ac, pAuthnSvc=0x2fe32c, pAuthzSvc=0x2fe328, pServerPrincName=0x2fe338, pAuthnLevel=0x2fe330, pImpLevel=0x2fe31c, pAuthInfo=0x2fe320, pCapabilites=0x2fe324 | out: pAuthnSvc=0x2fe32c*=0xa, pAuthzSvc=0x2fe328*=0x0, pServerPrincName=0x2fe338, pAuthnLevel=0x2fe330*=0x6, pImpLevel=0x2fe31c*=0x2, pAuthInfo=0x2fe320, pCapabilites=0x2fe324*=0x1) returned 0x0 [0091.819] WbemLocator:IUnknown:Release (This=0x6a638c) returned 0x2 [0091.819] WbemLocator:IUnknown:QueryInterface (in: This=0x6a63ac, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2d8 | out: ppvObject=0x2fe2d8*=0x6a63ac) returned 0x0 [0091.819] WbemLocator:IUnknown:QueryInterface (in: This=0x6a63ac, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2d4 | out: ppvObject=0x2fe2d4*=0x6a638c) returned 0x0 [0091.819] WbemLocator:IClientSecurity:SetBlanket (This=0x6a638c, pProxy=0x6a63ac, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0091.819] WbemLocator:IUnknown:Release (This=0x6a638c) returned 0x3 [0091.819] WbemLocator:IUnknown:Release (This=0x6a63ac) returned 0x2 [0091.819] CoTaskMemFree (pv=0x67cf30) [0091.819] WbemLocator:IUnknown:Release (This=0x6a63ac) returned 0x1 [0091.825] SysStringLen (param_1=0x0) returned 0x0 [0091.826] GetLastError () returned 0x7e [0091.826] CoGetContextToken (in: pToken=0x2fe460 | out: pToken=0x2fe460) returned 0x0 [0091.826] CoGetContextToken (in: pToken=0x2fe420 | out: pToken=0x2fe420) returned 0x0 [0091.826] WbemLocator:IUnknown:AddRef (This=0x6a63ac) returned 0x2 [0091.826] WbemLocator:IUnknown:QueryInterface (in: This=0x6a63ac, riid=0x2fe49c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x2fe498 | out: ppvObject=0x2fe498*=0x7110b9c) returned 0x0 [0091.827] WbemLocator:IUnknown:Release (This=0x6a63ac) returned 0x2 [0091.827] WbemLocator:IUnknown:Release (This=0x7110b9c) returned 0x1 [0091.827] CoGetContextToken (in: pToken=0x2fdff4 | out: pToken=0x2fdff4) returned 0x0 [0091.827] CoGetContextToken (in: pToken=0x2fdfb4 | out: pToken=0x2fdfb4) returned 0x0 [0091.827] WbemLocator:IUnknown:AddRef (This=0x6a63ac) returned 0x2 [0091.827] WbemLocator:IUnknown:QueryInterface (in: This=0x6a63ac, riid=0x2fe030*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x2fe02c | out: ppvObject=0x2fe02c*=0x7110b9c) returned 0x0 [0091.827] WbemLocator:IUnknown:Release (This=0x6a63ac) returned 0x2 [0091.827] WbemLocator:IUnknown:AddRef (This=0x7110b9c) returned 0x3 [0091.827] WbemLocator:IUnknown:QueryInterface (in: This=0x7110b9c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2e4 | out: ppvObject=0x2fe2e4*=0x6a638c) returned 0x0 [0091.827] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6a638c, pProxy=0x7110b9c, pAuthnSvc=0x2fe32c, pAuthzSvc=0x2fe328, pServerPrincName=0x2fe338, pAuthnLevel=0x2fe330, pImpLevel=0x2fe31c, pAuthInfo=0x2fe320, pCapabilites=0x2fe324 | out: pAuthnSvc=0x2fe32c*=0xa, pAuthzSvc=0x2fe328*=0x0, pServerPrincName=0x2fe338, pAuthnLevel=0x2fe330*=0x6, pImpLevel=0x2fe31c*=0x2, pAuthInfo=0x2fe320, pCapabilites=0x2fe324*=0x1) returned 0x0 [0091.827] WbemLocator:IUnknown:Release (This=0x6a638c) returned 0x3 [0091.827] WbemLocator:IUnknown:QueryInterface (in: This=0x7110b9c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2d8 | out: ppvObject=0x2fe2d8*=0x6a63ac) returned 0x0 [0091.827] WbemLocator:IUnknown:QueryInterface (in: This=0x7110b9c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2d4 | out: ppvObject=0x2fe2d4*=0x6a638c) returned 0x0 [0091.827] WbemLocator:IClientSecurity:SetBlanket (This=0x6a638c, pProxy=0x7110b9c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0091.828] WbemLocator:IUnknown:Release (This=0x6a638c) returned 0x4 [0091.828] WbemLocator:IUnknown:Release (This=0x6a63ac) returned 0x3 [0091.828] CoTaskMemFree (pv=0x67ced0) [0091.828] WbemLocator:IUnknown:Release (This=0x7110b9c) returned 0x2 [0091.828] SysStringLen (param_1=0x0) returned 0x0 [0091.828] GetLastError () returned 0x0 [0091.828] CoGetContextToken (in: pToken=0x2fdd84 | out: pToken=0x2fdd84) returned 0x0 [0091.828] WbemLocator:IUnknown:AddRef (This=0x7110b9c) returned 0x3 [0091.828] IWbemServices:ExecQuery (in: This=0x7110b9c, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x2fe3c8 | out: ppEnum=0x2fe3c8*=0x711caf4) returned 0x0 [0091.832] IUnknown:QueryInterface (in: This=0x711caf4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe074 | out: ppvObject=0x2fe074*=0x711caf8) returned 0x0 [0091.832] IClientSecurity:QueryBlanket (in: This=0x711caf8, pProxy=0x711caf4, pAuthnSvc=0x2fe0bc, pAuthzSvc=0x2fe0b8, pServerPrincName=0x2fe0c8, pAuthnLevel=0x2fe0c0, pImpLevel=0x2fe0ac, pAuthInfo=0x2fe0b0, pCapabilites=0x2fe0b4 | out: pAuthnSvc=0x2fe0bc*=0xa, pAuthzSvc=0x2fe0b8*=0x0, pServerPrincName=0x2fe0c8, pAuthnLevel=0x2fe0c0*=0x6, pImpLevel=0x2fe0ac*=0x2, pAuthInfo=0x2fe0b0, pCapabilites=0x2fe0b4*=0x1) returned 0x0 [0091.832] IUnknown:Release (This=0x711caf8) returned 0x1 [0091.832] IUnknown:QueryInterface (in: This=0x711caf4, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe068 | out: ppvObject=0x2fe068*=0x6a696c) returned 0x0 [0091.833] IUnknown:QueryInterface (in: This=0x711caf4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe064 | out: ppvObject=0x2fe064*=0x711caf8) returned 0x0 [0091.833] IClientSecurity:SetBlanket (This=0x711caf8, pProxy=0x711caf4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0091.834] IUnknown:Release (This=0x711caf8) returned 0x2 [0091.834] WbemLocator:IUnknown:Release (This=0x6a696c) returned 0x1 [0091.834] CoTaskMemFree (pv=0x67cf60) [0091.835] WbemLocator:IUnknown:Release (This=0x7110b9c) returned 0x2 [0091.835] IUnknown:QueryInterface (in: This=0x711caf4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fda20 | out: ppvObject=0x2fda20*=0x6a696c) returned 0x0 [0091.835] WbemLocator:IUnknown:QueryInterface (in: This=0x6a696c, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fd9dc | out: ppvObject=0x2fd9dc*=0x0) returned 0x80004002 [0091.835] WbemLocator:IUnknown:QueryInterface (in: This=0x6a696c, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fd8d0 | out: ppvObject=0x2fd8d0*=0x0) returned 0x80004002 [0091.835] WbemLocator:IUnknown:AddRef (This=0x6a696c) returned 0x3 [0091.836] CoGetContextToken (in: pToken=0x2fd868 | out: pToken=0x2fd868) returned 0x0 [0091.836] CoGetContextToken (in: pToken=0x2fd82c | out: pToken=0x2fd82c) returned 0x0 [0091.836] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd860 | out: ppvObject=0x2fd860*=0x6484cc) returned 0x0 [0091.836] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fd890 | out: pAptType=0x2fd890*=3) returned 0x0 [0091.836] IUnknown:Release (This=0x6484cc) returned 0x1 [0091.836] WbemLocator:IUnknown:QueryInterface (in: This=0x6a696c, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd850 | out: ppvObject=0x2fd850*=0x6a68cc) returned 0x0 [0091.836] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6a68cc, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fd858 | out: pCid=0x2fd858*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0091.836] WbemLocator:IUnknown:Release (This=0x6a68cc) returned 0x3 [0091.836] CoGetContextToken (in: pToken=0x2fd860 | out: pToken=0x2fd860) returned 0x0 [0091.836] WbemLocator:IUnknown:AddRef (This=0x6a696c) returned 0x4 [0091.836] WbemLocator:IUnknown:QueryInterface (in: This=0x6a696c, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd8d4 | out: ppvObject=0x2fd8d4*=0x6a6954) returned 0x0 [0091.836] WbemLocator:IUnknown:Release (This=0x6a696c) returned 0x4 [0091.836] WbemLocator:IRpcOptions:Query (in: This=0x6a6954, pPrx=0x6a696c, dwProperty=2, pdwValue=0x2fd8f8 | out: pdwValue=0x2fd8f8) returned 0x80004002 [0091.836] WbemLocator:IUnknown:Release (This=0x6a6954) returned 0x3 [0091.836] WbemLocator:IUnknown:Release (This=0x6a696c) returned 0x2 [0091.836] CoGetContextToken (in: pToken=0x2fdcd4 | out: pToken=0x2fdcd4) returned 0x0 [0091.836] CoGetContextToken (in: pToken=0x2fdc94 | out: pToken=0x2fdc94) returned 0x0 [0091.836] WbemLocator:IUnknown:AddRef (This=0x6a696c) returned 0x3 [0091.837] WbemLocator:IUnknown:QueryInterface (in: This=0x6a696c, riid=0x2fdd10*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x2fdd0c | out: ppvObject=0x2fdd0c*=0x711caf4) returned 0x0 [0091.837] WbemLocator:IUnknown:Release (This=0x6a696c) returned 0x3 [0091.837] IUnknown:Release (This=0x711caf4) returned 0x2 [0091.837] IUnknown:Release (This=0x711caf4) returned 0x1 [0091.837] CoGetContextToken (in: pToken=0x2fe4ac | out: pToken=0x2fe4ac) returned 0x0 [0091.837] CoGetContextToken (in: pToken=0x2fe46c | out: pToken=0x2fe46c) returned 0x0 [0091.837] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0091.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe4e8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe4e4 | out: ppvObject=0x2fe4e4*=0x71108b8) returned 0x0 [0091.837] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0091.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x71108b8, puCount=0x2fe660 | out: puCount=0x2fe660*=0x2) returned 0x0 [0091.837] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.837] CoGetContextToken (in: pToken=0x2fe49c | out: pToken=0x2fe49c) returned 0x0 [0091.837] CoGetContextToken (in: pToken=0x2fe45c | out: pToken=0x2fe45c) returned 0x0 [0091.837] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0091.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe4d8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe4d4 | out: ppvObject=0x2fe4d4*=0x71108b8) returned 0x0 [0091.837] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0091.837] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe65c*=0x0, pszText=0x0 | out: puBuffLength=0x2fe65c*=0xf, pszText=0x0) returned 0x0 [0091.838] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.838] CoGetContextToken (in: pToken=0x2fe49c | out: pToken=0x2fe49c) returned 0x0 [0091.838] CoGetContextToken (in: pToken=0x2fe45c | out: pToken=0x2fe45c) returned 0x0 [0091.838] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0091.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe4d8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe4d4 | out: ppvObject=0x2fe4d4*=0x71108b8) returned 0x0 [0091.838] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0091.838] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe65c*=0xf, pszText="00000000000000" | out: puBuffLength=0x2fe65c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0091.838] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.838] CoGetContextToken (in: pToken=0x2fdfec | out: pToken=0x2fdfec) returned 0x0 [0091.838] CoGetContextToken (in: pToken=0x2fdfac | out: pToken=0x2fdfac) returned 0x0 [0091.838] WbemLocator:IUnknown:AddRef (This=0x6a696c) returned 0x2 [0091.838] WbemLocator:IUnknown:QueryInterface (in: This=0x6a696c, riid=0x2fe028*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x2fe024 | out: ppvObject=0x2fe024*=0x711caf4) returned 0x0 [0091.838] WbemLocator:IUnknown:Release (This=0x6a696c) returned 0x2 [0091.838] IUnknown:AddRef (This=0x711caf4) returned 0x3 [0091.838] IEnumWbemClassObject:Clone (in: This=0x711caf4, ppEnum=0x2fe620 | out: ppEnum=0x2fe620*=0x711cbbc) returned 0x0 [0091.839] IUnknown:QueryInterface (in: This=0x711cbbc, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2dc | out: ppvObject=0x2fe2dc*=0x711cbc0) returned 0x0 [0091.839] IClientSecurity:QueryBlanket (in: This=0x711cbc0, pProxy=0x711cbbc, pAuthnSvc=0x2fe324, pAuthzSvc=0x2fe320, pServerPrincName=0x2fe330, pAuthnLevel=0x2fe328, pImpLevel=0x2fe314, pAuthInfo=0x2fe318, pCapabilites=0x2fe31c | out: pAuthnSvc=0x2fe324*=0xa, pAuthzSvc=0x2fe320*=0x0, pServerPrincName=0x2fe330, pAuthnLevel=0x2fe328*=0x6, pImpLevel=0x2fe314*=0x2, pAuthInfo=0x2fe318, pCapabilites=0x2fe31c*=0x1) returned 0x0 [0091.839] IUnknown:Release (This=0x711cbc0) returned 0x1 [0091.839] IUnknown:QueryInterface (in: This=0x711cbbc, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2d0 | out: ppvObject=0x2fe2d0*=0x6aa8ac) returned 0x0 [0091.840] IUnknown:QueryInterface (in: This=0x711cbbc, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2cc | out: ppvObject=0x2fe2cc*=0x711cbc0) returned 0x0 [0091.840] IClientSecurity:SetBlanket (This=0x711cbc0, pProxy=0x711cbbc, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0091.840] IUnknown:Release (This=0x711cbc0) returned 0x2 [0091.840] WbemLocator:IUnknown:Release (This=0x6aa8ac) returned 0x1 [0091.840] CoTaskMemFree (pv=0x67cf30) [0091.841] IUnknown:Release (This=0x711caf4) returned 0x2 [0091.841] IUnknown:QueryInterface (in: This=0x711cbbc, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdc78 | out: ppvObject=0x2fdc78*=0x6aa8ac) returned 0x0 [0091.841] WbemLocator:IUnknown:QueryInterface (in: This=0x6aa8ac, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fdc34 | out: ppvObject=0x2fdc34*=0x0) returned 0x80004002 [0091.841] WbemLocator:IUnknown:QueryInterface (in: This=0x6aa8ac, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fdb28 | out: ppvObject=0x2fdb28*=0x0) returned 0x80004002 [0091.841] WbemLocator:IUnknown:AddRef (This=0x6aa8ac) returned 0x3 [0091.841] CoGetContextToken (in: pToken=0x2fdac0 | out: pToken=0x2fdac0) returned 0x0 [0091.841] CoGetContextToken (in: pToken=0x2fda84 | out: pToken=0x2fda84) returned 0x0 [0091.842] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdab8 | out: ppvObject=0x2fdab8*=0x6484cc) returned 0x0 [0091.842] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdae8 | out: pAptType=0x2fdae8*=3) returned 0x0 [0091.842] IUnknown:Release (This=0x6484cc) returned 0x1 [0091.842] WbemLocator:IUnknown:QueryInterface (in: This=0x6aa8ac, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdaa8 | out: ppvObject=0x2fdaa8*=0x6aa80c) returned 0x0 [0091.842] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6aa80c, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fdab0 | out: pCid=0x2fdab0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0091.842] WbemLocator:IUnknown:Release (This=0x6aa80c) returned 0x3 [0091.842] CoGetContextToken (in: pToken=0x2fdab8 | out: pToken=0x2fdab8) returned 0x0 [0091.842] WbemLocator:IUnknown:AddRef (This=0x6aa8ac) returned 0x4 [0091.842] WbemLocator:IUnknown:QueryInterface (in: This=0x6aa8ac, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdb2c | out: ppvObject=0x2fdb2c*=0x6aa894) returned 0x0 [0091.842] WbemLocator:IUnknown:Release (This=0x6aa8ac) returned 0x4 [0091.842] WbemLocator:IRpcOptions:Query (in: This=0x6aa894, pPrx=0x6aa8ac, dwProperty=2, pdwValue=0x2fdb50 | out: pdwValue=0x2fdb50) returned 0x80004002 [0091.842] WbemLocator:IUnknown:Release (This=0x6aa894) returned 0x3 [0091.842] WbemLocator:IUnknown:Release (This=0x6aa8ac) returned 0x2 [0091.842] CoGetContextToken (in: pToken=0x2fdf2c | out: pToken=0x2fdf2c) returned 0x0 [0091.842] CoGetContextToken (in: pToken=0x2fdeec | out: pToken=0x2fdeec) returned 0x0 [0091.842] WbemLocator:IUnknown:AddRef (This=0x6aa8ac) returned 0x3 [0091.842] WbemLocator:IUnknown:QueryInterface (in: This=0x6aa8ac, riid=0x2fdf68*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x2fdf64 | out: ppvObject=0x2fdf64*=0x711cbbc) returned 0x0 [0091.843] WbemLocator:IUnknown:Release (This=0x6aa8ac) returned 0x3 [0091.843] IUnknown:Release (This=0x711cbbc) returned 0x2 [0091.843] IUnknown:Release (This=0x711cbbc) returned 0x1 [0091.846] CoGetContextToken (in: pToken=0x2fe520 | out: pToken=0x2fe520) returned 0x0 [0091.846] CoGetContextToken (in: pToken=0x2fe4e0 | out: pToken=0x2fe4e0) returned 0x0 [0091.846] WbemLocator:IUnknown:AddRef (This=0x6aa8ac) returned 0x2 [0091.846] WbemLocator:IUnknown:QueryInterface (in: This=0x6aa8ac, riid=0x2fe55c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x2fe558 | out: ppvObject=0x2fe558*=0x711cbbc) returned 0x0 [0091.847] WbemLocator:IUnknown:Release (This=0x6aa8ac) returned 0x2 [0091.847] IUnknown:AddRef (This=0x711cbbc) returned 0x3 [0091.847] IEnumWbemClassObject:Reset (This=0x711cbbc) returned 0x0 [0091.848] IUnknown:Release (This=0x711cbbc) returned 0x2 [0091.850] CoGetContextToken (in: pToken=0x2fe40c | out: pToken=0x2fe40c) returned 0x0 [0091.850] IUnknown:AddRef (This=0x711cbbc) returned 0x3 [0091.850] IEnumWbemClassObject:Next (in: This=0x711cbbc, lTimeout=-1, uCount=0x1, apObjects=0x650cf0, puReturned=0x1c08698 | out: apObjects=0x650cf0*=0x711cbf8, puReturned=0x1c08698*=0x1) returned 0x0 [0092.276] IUnknown:QueryInterface (in: This=0x711cbf8, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fda18 | out: ppvObject=0x2fda18*=0x711cbf8) returned 0x0 [0092.276] IUnknown:QueryInterface (in: This=0x711cbf8, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fd9d4 | out: ppvObject=0x2fd9d4*=0x0) returned 0x80004002 [0092.276] IUnknown:QueryInterface (in: This=0x711cbf8, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fd8c8 | out: ppvObject=0x2fd8c8*=0x0) returned 0x80004002 [0092.277] IUnknown:AddRef (This=0x711cbf8) returned 0x3 [0092.277] CoGetContextToken (in: pToken=0x2fd860 | out: pToken=0x2fd860) returned 0x0 [0092.277] CoGetContextToken (in: pToken=0x2fd824 | out: pToken=0x2fd824) returned 0x0 [0092.277] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd858 | out: ppvObject=0x2fd858*=0x6484cc) returned 0x0 [0092.277] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fd888 | out: pAptType=0x2fd888*=3) returned 0x0 [0092.277] IUnknown:Release (This=0x6484cc) returned 0x1 [0092.277] IUnknown:QueryInterface (in: This=0x711cbf8, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd848 | out: ppvObject=0x2fd848*=0x711cbfc) returned 0x0 [0092.277] IMarshal:GetUnmarshalClass (in: This=0x711cbfc, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fd850 | out: pCid=0x2fd850*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0092.277] IUnknown:Release (This=0x711cbfc) returned 0x3 [0092.277] CoGetContextToken (in: pToken=0x2fd858 | out: pToken=0x2fd858) returned 0x0 [0092.277] IUnknown:AddRef (This=0x711cbf8) returned 0x4 [0092.277] IUnknown:QueryInterface (in: This=0x711cbf8, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd8cc | out: ppvObject=0x2fd8cc*=0x0) returned 0x80004002 [0092.277] IUnknown:Release (This=0x711cbf8) returned 0x3 [0092.277] IUnknown:Release (This=0x711cbf8) returned 0x2 [0092.278] CoGetContextToken (in: pToken=0x2fdcb8 | out: pToken=0x2fdcb8) returned 0x0 [0092.278] CoGetContextToken (in: pToken=0x2fdc78 | out: pToken=0x2fdc78) returned 0x0 [0092.278] IUnknown:AddRef (This=0x711cbf8) returned 0x3 [0092.278] IUnknown:QueryInterface (in: This=0x711cbf8, riid=0x2fdcf4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x2fdcf0 | out: ppvObject=0x2fdcf0*=0x711cbf8) returned 0x0 [0092.278] IUnknown:Release (This=0x711cbf8) returned 0x3 [0092.278] IUnknown:Release (This=0x711cbf8) returned 0x2 [0092.278] IUnknown:Release (This=0x711cbf8) returned 0x1 [0092.278] IUnknown:Release (This=0x711cbbc) returned 0x2 [0092.278] CoGetContextToken (in: pToken=0x2fe5a4 | out: pToken=0x2fe5a4) returned 0x0 [0092.278] IUnknown:AddRef (This=0x711cbf8) returned 0x2 [0092.278] CoGetContextToken (in: pToken=0x2fe40c | out: pToken=0x2fe40c) returned 0x0 [0092.278] IUnknown:AddRef (This=0x711cbbc) returned 0x3 [0092.278] IEnumWbemClassObject:Next (in: This=0x711cbbc, lTimeout=-1, uCount=0x1, apObjects=0x650cf0, puReturned=0x1c08698 | out: apObjects=0x650cf0*=0x0, puReturned=0x1c08698*=0x0) returned 0x1 [0092.279] IUnknown:Release (This=0x711cbbc) returned 0x2 [0092.279] CoGetContextToken (in: pToken=0x2fdffc | out: pToken=0x2fdffc) returned 0x0 [0092.279] IUnknown:AddRef (This=0x711caf4) returned 0x3 [0092.279] IEnumWbemClassObject:Clone (in: This=0x711caf4, ppEnum=0x2fe630 | out: ppEnum=0x2fe630*=0x712296c) returned 0x0 [0092.280] IUnknown:QueryInterface (in: This=0x712296c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2ec | out: ppvObject=0x2fe2ec*=0x7122970) returned 0x0 [0092.280] IClientSecurity:QueryBlanket (in: This=0x7122970, pProxy=0x712296c, pAuthnSvc=0x2fe334, pAuthzSvc=0x2fe330, pServerPrincName=0x2fe340, pAuthnLevel=0x2fe338, pImpLevel=0x2fe324, pAuthInfo=0x2fe328, pCapabilites=0x2fe32c | out: pAuthnSvc=0x2fe334*=0xa, pAuthzSvc=0x2fe330*=0x0, pServerPrincName=0x2fe340, pAuthnLevel=0x2fe338*=0x6, pImpLevel=0x2fe324*=0x2, pAuthInfo=0x2fe328, pCapabilites=0x2fe32c*=0x1) returned 0x0 [0092.280] IUnknown:Release (This=0x7122970) returned 0x1 [0092.280] IUnknown:QueryInterface (in: This=0x712296c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2e0 | out: ppvObject=0x2fe2e0*=0x6ac39c) returned 0x0 [0092.280] IUnknown:QueryInterface (in: This=0x712296c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2dc | out: ppvObject=0x2fe2dc*=0x7122970) returned 0x0 [0092.280] IClientSecurity:SetBlanket (This=0x7122970, pProxy=0x712296c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0092.281] IUnknown:Release (This=0x7122970) returned 0x2 [0092.281] WbemLocator:IUnknown:Release (This=0x6ac39c) returned 0x1 [0092.281] CoTaskMemFree (pv=0x67cf60) [0092.281] IUnknown:Release (This=0x711caf4) returned 0x2 [0092.281] IUnknown:QueryInterface (in: This=0x712296c, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdc88 | out: ppvObject=0x2fdc88*=0x6ac39c) returned 0x0 [0092.282] WbemLocator:IUnknown:QueryInterface (in: This=0x6ac39c, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fdc44 | out: ppvObject=0x2fdc44*=0x0) returned 0x80004002 [0092.282] WbemLocator:IUnknown:QueryInterface (in: This=0x6ac39c, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fdb38 | out: ppvObject=0x2fdb38*=0x0) returned 0x80004002 [0092.282] WbemLocator:IUnknown:AddRef (This=0x6ac39c) returned 0x3 [0092.282] CoGetContextToken (in: pToken=0x2fdad0 | out: pToken=0x2fdad0) returned 0x0 [0092.282] CoGetContextToken (in: pToken=0x2fda94 | out: pToken=0x2fda94) returned 0x0 [0092.282] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdac8 | out: ppvObject=0x2fdac8*=0x6484cc) returned 0x0 [0092.282] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdaf8 | out: pAptType=0x2fdaf8*=3) returned 0x0 [0092.283] IUnknown:Release (This=0x6484cc) returned 0x1 [0092.283] WbemLocator:IUnknown:QueryInterface (in: This=0x6ac39c, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdab8 | out: ppvObject=0x2fdab8*=0x6ac2fc) returned 0x0 [0092.283] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6ac2fc, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fdac0 | out: pCid=0x2fdac0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0092.283] WbemLocator:IUnknown:Release (This=0x6ac2fc) returned 0x3 [0092.283] CoGetContextToken (in: pToken=0x2fdac8 | out: pToken=0x2fdac8) returned 0x0 [0092.283] WbemLocator:IUnknown:AddRef (This=0x6ac39c) returned 0x4 [0092.283] WbemLocator:IUnknown:QueryInterface (in: This=0x6ac39c, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdb3c | out: ppvObject=0x2fdb3c*=0x6ac384) returned 0x0 [0092.283] WbemLocator:IUnknown:Release (This=0x6ac39c) returned 0x4 [0092.283] WbemLocator:IRpcOptions:Query (in: This=0x6ac384, pPrx=0x6ac39c, dwProperty=2, pdwValue=0x2fdb60 | out: pdwValue=0x2fdb60) returned 0x80004002 [0092.283] WbemLocator:IUnknown:Release (This=0x6ac384) returned 0x3 [0092.283] WbemLocator:IUnknown:Release (This=0x6ac39c) returned 0x2 [0092.283] CoGetContextToken (in: pToken=0x2fdf3c | out: pToken=0x2fdf3c) returned 0x0 [0092.283] CoGetContextToken (in: pToken=0x2fdefc | out: pToken=0x2fdefc) returned 0x0 [0092.283] WbemLocator:IUnknown:AddRef (This=0x6ac39c) returned 0x3 [0092.283] WbemLocator:IUnknown:QueryInterface (in: This=0x6ac39c, riid=0x2fdf78*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x2fdf74 | out: ppvObject=0x2fdf74*=0x712296c) returned 0x0 [0092.284] WbemLocator:IUnknown:Release (This=0x6ac39c) returned 0x3 [0092.284] IUnknown:Release (This=0x712296c) returned 0x2 [0092.284] IUnknown:Release (This=0x712296c) returned 0x1 [0092.284] CoGetContextToken (in: pToken=0x2fe530 | out: pToken=0x2fe530) returned 0x0 [0092.284] CoGetContextToken (in: pToken=0x2fe4f0 | out: pToken=0x2fe4f0) returned 0x0 [0092.284] WbemLocator:IUnknown:AddRef (This=0x6ac39c) returned 0x2 [0092.284] WbemLocator:IUnknown:QueryInterface (in: This=0x6ac39c, riid=0x2fe56c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x2fe568 | out: ppvObject=0x2fe568*=0x712296c) returned 0x0 [0092.285] WbemLocator:IUnknown:Release (This=0x6ac39c) returned 0x2 [0092.285] IUnknown:AddRef (This=0x712296c) returned 0x3 [0092.285] IEnumWbemClassObject:Reset (This=0x712296c) returned 0x0 [0092.285] IUnknown:Release (This=0x712296c) returned 0x2 [0092.285] CoGetContextToken (in: pToken=0x2fe41c | out: pToken=0x2fe41c) returned 0x0 [0092.285] IUnknown:AddRef (This=0x712296c) returned 0x3 [0092.285] IEnumWbemClassObject:Next (in: This=0x712296c, lTimeout=-1, uCount=0x1, apObjects=0x650cf0, puReturned=0x1c08788 | out: apObjects=0x650cf0*=0x71229a8, puReturned=0x1c08788*=0x1) returned 0x0 [0092.288] IUnknown:QueryInterface (in: This=0x71229a8, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fda28 | out: ppvObject=0x2fda28*=0x71229a8) returned 0x0 [0092.288] IUnknown:QueryInterface (in: This=0x71229a8, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fd9e4 | out: ppvObject=0x2fd9e4*=0x0) returned 0x80004002 [0092.288] IUnknown:QueryInterface (in: This=0x71229a8, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fd8d8 | out: ppvObject=0x2fd8d8*=0x0) returned 0x80004002 [0092.288] IUnknown:AddRef (This=0x71229a8) returned 0x3 [0092.288] CoGetContextToken (in: pToken=0x2fd870 | out: pToken=0x2fd870) returned 0x0 [0092.288] CoGetContextToken (in: pToken=0x2fd834 | out: pToken=0x2fd834) returned 0x0 [0092.288] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd868 | out: ppvObject=0x2fd868*=0x6484cc) returned 0x0 [0092.288] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fd898 | out: pAptType=0x2fd898*=3) returned 0x0 [0092.288] IUnknown:Release (This=0x6484cc) returned 0x1 [0092.288] IUnknown:QueryInterface (in: This=0x71229a8, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd858 | out: ppvObject=0x2fd858*=0x71229ac) returned 0x0 [0092.288] IMarshal:GetUnmarshalClass (in: This=0x71229ac, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fd860 | out: pCid=0x2fd860*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0092.288] IUnknown:Release (This=0x71229ac) returned 0x3 [0092.289] CoGetContextToken (in: pToken=0x2fd868 | out: pToken=0x2fd868) returned 0x0 [0092.289] IUnknown:AddRef (This=0x71229a8) returned 0x4 [0092.289] IUnknown:QueryInterface (in: This=0x71229a8, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd8dc | out: ppvObject=0x2fd8dc*=0x0) returned 0x80004002 [0092.289] IUnknown:Release (This=0x71229a8) returned 0x3 [0092.289] IUnknown:Release (This=0x71229a8) returned 0x2 [0092.289] CoGetContextToken (in: pToken=0x2fdcc8 | out: pToken=0x2fdcc8) returned 0x0 [0092.289] CoGetContextToken (in: pToken=0x2fdc88 | out: pToken=0x2fdc88) returned 0x0 [0092.289] IUnknown:AddRef (This=0x71229a8) returned 0x3 [0092.289] IUnknown:QueryInterface (in: This=0x71229a8, riid=0x2fdd04*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x2fdd00 | out: ppvObject=0x2fdd00*=0x71229a8) returned 0x0 [0092.289] IUnknown:Release (This=0x71229a8) returned 0x3 [0092.289] IUnknown:Release (This=0x71229a8) returned 0x2 [0092.289] IUnknown:Release (This=0x71229a8) returned 0x1 [0092.289] IUnknown:Release (This=0x712296c) returned 0x2 [0092.289] CoGetContextToken (in: pToken=0x2fe5b4 | out: pToken=0x2fe5b4) returned 0x0 [0092.289] IUnknown:AddRef (This=0x71229a8) returned 0x2 [0092.292] IWbemClassObject:Get (in: This=0x71229a8, wszName="__GENUS", lFlags=0, pVal=0x2fe630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2fe6e4*=0, plFlavor=0x2fe6e0*=0 | out: pVal=0x2fe630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2fe6e4*=3, plFlavor=0x2fe6e0*=64) returned 0x0 [0092.293] IWbemClassObject:Get (in: This=0x71229a8, wszName="__PATH", lFlags=0, pVal=0x2fe610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2fe6c8*=0, plFlavor=0x2fe6c4*=0 | out: pVal=0x2fe610*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\ARRARNMKU\\root\\cimv2:Win32_OperatingSystem=@", varVal2=0x0), pType=0x2fe6c8*=8, plFlavor=0x2fe6c4*=64) returned 0x0 [0092.293] SysStringLen (param_1="\\\\ARRARNMKU\\root\\cimv2:Win32_OperatingSystem=@") returned 0x2e [0092.293] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x338 [0092.293] GetLastError () returned 0x0 [0092.294] SetEvent (hEvent=0x27c) returned 1 [0092.294] GetLastError () returned 0x0 [0092.294] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2fe62c*=0x338, lpdwindex=0x2fe3e4 | out: lpdwindex=0x2fe3e4) returned 0x0 [0092.296] CoGetContextToken (in: pToken=0x2fe47c | out: pToken=0x2fe47c) returned 0x0 [0092.296] CoGetContextToken (in: pToken=0x2fe43c | out: pToken=0x2fe43c) returned 0x0 [0092.296] WbemDefPath:IUnknown:AddRef (This=0x71259c8) returned 0x2 [0092.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x71259c8, riid=0x2fe4b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe4b4 | out: ppvObject=0x2fe4b4*=0x71259c8) returned 0x0 [0092.296] WbemDefPath:IUnknown:Release (This=0x71259c8) returned 0x2 [0092.296] WbemDefPath:IUnknown:Release (This=0x71259c8) returned 0x1 [0092.296] CoGetContextToken (in: pToken=0x2fe4fc | out: pToken=0x2fe4fc) returned 0x0 [0092.296] CoGetContextToken (in: pToken=0x2fe4bc | out: pToken=0x2fe4bc) returned 0x0 [0092.296] WbemDefPath:IUnknown:AddRef (This=0x71259c8) returned 0x2 [0092.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x71259c8, riid=0x2fe538*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe534 | out: ppvObject=0x2fe534*=0x71259c8) returned 0x0 [0092.296] WbemDefPath:IUnknown:Release (This=0x71259c8) returned 0x2 [0092.297] WbemDefPath:IWbemPath:SetText (This=0x71259c8, uMode=0x4, pszPath="\\\\ARRARNMKU\\root\\cimv2:Win32_OperatingSystem=@") returned 0x0 [0092.297] WbemDefPath:IUnknown:Release (This=0x71259c8) returned 0x1 [0092.297] CoGetContextToken (in: pToken=0x2fe4e8 | out: pToken=0x2fe4e8) returned 0x0 [0092.297] CoGetContextToken (in: pToken=0x2fe4a8 | out: pToken=0x2fe4a8) returned 0x0 [0092.297] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0092.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe524*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe520 | out: ppvObject=0x2fe520*=0x71108b8) returned 0x0 [0092.297] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0092.297] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x71108b8, puCount=0x2fe69c | out: puCount=0x2fe69c*=0x2) returned 0x0 [0092.297] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0092.297] CoGetContextToken (in: pToken=0x2fe4d8 | out: pToken=0x2fe4d8) returned 0x0 [0092.297] CoGetContextToken (in: pToken=0x2fe498 | out: pToken=0x2fe498) returned 0x0 [0092.297] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0092.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe514*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe510 | out: ppvObject=0x2fe510*=0x71108b8) returned 0x0 [0092.297] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0092.297] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe698*=0x0, pszText=0x0 | out: puBuffLength=0x2fe698*=0xf, pszText=0x0) returned 0x0 [0092.297] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0092.297] CoGetContextToken (in: pToken=0x2fe4d8 | out: pToken=0x2fe4d8) returned 0x0 [0092.297] CoGetContextToken (in: pToken=0x2fe498 | out: pToken=0x2fe498) returned 0x0 [0092.298] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0092.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe514*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe510 | out: ppvObject=0x2fe510*=0x71108b8) returned 0x0 [0092.298] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0092.298] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe698*=0xf, pszText="00000000000000" | out: puBuffLength=0x2fe698*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0092.298] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0092.298] CoGetContextToken (in: pToken=0x2fe4e8 | out: pToken=0x2fe4e8) returned 0x0 [0092.298] CoGetContextToken (in: pToken=0x2fe4a8 | out: pToken=0x2fe4a8) returned 0x0 [0092.298] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0092.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe524*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe520 | out: ppvObject=0x2fe520*=0x71108b8) returned 0x0 [0092.298] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0092.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x71108b8, puCount=0x2fe69c | out: puCount=0x2fe69c*=0x2) returned 0x0 [0092.299] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0092.299] CoGetContextToken (in: pToken=0x2fe4d8 | out: pToken=0x2fe4d8) returned 0x0 [0092.299] CoGetContextToken (in: pToken=0x2fe498 | out: pToken=0x2fe498) returned 0x0 [0092.299] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0092.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe514*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe510 | out: ppvObject=0x2fe510*=0x71108b8) returned 0x0 [0092.299] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0092.299] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe698*=0x0, pszText=0x0 | out: puBuffLength=0x2fe698*=0xf, pszText=0x0) returned 0x0 [0092.299] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0092.299] CoGetContextToken (in: pToken=0x2fe4d8 | out: pToken=0x2fe4d8) returned 0x0 [0092.299] CoGetContextToken (in: pToken=0x2fe498 | out: pToken=0x2fe498) returned 0x0 [0092.299] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0092.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe514*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe510 | out: ppvObject=0x2fe510*=0x71108b8) returned 0x0 [0092.300] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0092.300] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe698*=0xf, pszText="00000000000000" | out: puBuffLength=0x2fe698*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0092.300] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0092.300] IWbemClassObject:Get (in: This=0x71229a8, wszName="Name", lFlags=0, pVal=0x2fe658*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c09258*=0, plFlavor=0x1c0925c*=0 | out: pVal=0x2fe658*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x1c09258*=8, plFlavor=0x1c0925c*=0) returned 0x0 [0092.300] SysStringLen (param_1="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x49 [0092.300] IWbemClassObject:Get (in: This=0x71229a8, wszName="Name", lFlags=0, pVal=0x2fe65c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c09258*=8, plFlavor=0x1c0925c*=0 | out: pVal=0x2fe65c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x1c09258*=8, plFlavor=0x1c0925c*=0) returned 0x0 [0092.300] SysStringLen (param_1="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x49 [0092.308] CoGetContextToken (in: pToken=0x2fe4e8 | out: pToken=0x2fe4e8) returned 0x0 [0092.308] CoGetContextToken (in: pToken=0x2fe4a8 | out: pToken=0x2fe4a8) returned 0x0 [0092.308] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0092.308] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe524*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe520 | out: ppvObject=0x2fe520*=0x71108b8) returned 0x0 [0092.308] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0092.308] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x71108b8, puCount=0x2fe69c | out: puCount=0x2fe69c*=0x2) returned 0x0 [0092.308] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0092.308] CoGetContextToken (in: pToken=0x2fe4d8 | out: pToken=0x2fe4d8) returned 0x0 [0092.308] CoGetContextToken (in: pToken=0x2fe498 | out: pToken=0x2fe498) returned 0x0 [0092.308] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0092.308] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe514*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe510 | out: ppvObject=0x2fe510*=0x71108b8) returned 0x0 [0092.309] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0092.309] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe698*=0x0, pszText=0x0 | out: puBuffLength=0x2fe698*=0xf, pszText=0x0) returned 0x0 [0092.309] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0092.309] CoGetContextToken (in: pToken=0x2fe4d8 | out: pToken=0x2fe4d8) returned 0x0 [0092.309] CoGetContextToken (in: pToken=0x2fe498 | out: pToken=0x2fe498) returned 0x0 [0092.309] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0092.309] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe514*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe510 | out: ppvObject=0x2fe510*=0x71108b8) returned 0x0 [0092.309] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0092.309] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe698*=0xf, pszText="00000000000000" | out: puBuffLength=0x2fe698*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0092.309] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0092.309] IWbemClassObject:Get (in: This=0x71229a8, wszName="Name", lFlags=0, pVal=0x2fe658*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c094b4*=0, plFlavor=0x1c094b8*=0 | out: pVal=0x2fe658*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x1c094b4*=8, plFlavor=0x1c094b8*=0) returned 0x0 [0092.309] SysStringLen (param_1="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x49 [0092.309] IWbemClassObject:Get (in: This=0x71229a8, wszName="Name", lFlags=0, pVal=0x2fe65c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c094b4*=8, plFlavor=0x1c094b8*=0 | out: pVal=0x2fe65c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x1c094b4*=8, plFlavor=0x1c094b8*=0) returned 0x0 [0092.309] SysStringLen (param_1="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x49 [0092.310] GetUserNameW (in: lpBuffer=0x68b9a8, pcbBuffer=0x2fe784 | out: lpBuffer="JPenUM", pcbBuffer=0x2fe784) returned 1 [0092.332] GetSystemMetrics (nIndex=80) returned 1 [0092.335] GetDC (hWnd=0x0) returned 0x5010946 [0092.341] EnumDisplayMonitors (hdc=0x5010946, lprcClip=0x0, lpfnEnum=0xd0fea, dwData=0x0) returned 1 [0092.345] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x650d48 | out: lpmi=0x650d48) returned 1 [0092.363] GetDeviceCaps (hdc=0x70109c2, index=12) returned 32 [0092.363] GetLastError () returned 0x0 [0092.363] GetDeviceCaps (hdc=0x70109c2, index=14) returned 1 [0092.363] GetLastError () returned 0x0 [0092.365] ReleaseDC (hWnd=0x0, hDC=0x5010946) returned 1 [0092.366] GetProcessWindowStation () returned 0x40 [0092.366] GetUserObjectInformationA (in: hObj=0x40, nIndex=1, pvInfo=0x1c09eb4, nLength=0xc, lpnLengthNeeded=0x2fe6cc | out: pvInfo=0x1c09eb4, lpnLengthNeeded=0x2fe6cc) returned 1 [0092.366] GetLastError () returned 0x0 [0092.368] SetConsoleCtrlHandler (HandlerRoutine=0xd1222, Add=1) returned 1 [0092.368] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0092.369] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0092.370] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", lpWndClass=0x1c09efc | out: lpWndClass=0x1c09efc) returned 0 [0092.372] CoTaskMemAlloc (cb=0x58) returned 0x6ac778 [0092.372] RegisterClassW (lpWndClass=0x650cf0) returned 0xc1dd [0092.372] GetLastError () returned 0x583 [0092.372] CoTaskMemFree (pv=0x6ac778) [0092.373] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x30282 [0092.374] DefWindowProcW (hWnd=0x30282, Msg=0x81, wParam=0x0, lParam=0x2fe16c) returned 0x1 [0092.375] DefWindowProcW (hWnd=0x30282, Msg=0x83, wParam=0x0, lParam=0x2fe1f0) returned 0x0 [0092.375] DefWindowProcW (hWnd=0x30282, Msg=0x1, wParam=0x0, lParam=0x2fe10c) returned 0x0 [0092.375] DefWindowProcW (hWnd=0x30282, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0092.375] DefWindowProcW (hWnd=0x30282, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0092.375] GetLastError () returned 0x0 [0092.394] gethostname (in: name=0x650cf0, namelen=256 | out: name="ArRARNMKU") returned 0 [0092.428] GetLastError () returned 0x0 [0092.448] GetCurrentProcess () returned 0xffffffff [0092.448] GetLastError () returned 0x3f0 [0092.448] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fe25c | out: TokenHandle=0x2fe25c*=0x3a8) returned 1 [0092.448] GetLastError () returned 0x3f0 [0092.456] GetCurrentProcess () returned 0xffffffff [0092.456] GetLastError () returned 0x3f0 [0092.457] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fe26c | out: TokenHandle=0x2fe26c*=0x3ac) returned 1 [0092.457] GetLastError () returned 0x3f0 [0092.461] gethostbyname (name="ArRARNMKU") returned 0x6a16580*(h_name="ArRARNMKU", h_aliases=0x6a16590*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x6a16594*=([0]="192.168.0.219")) [0092.469] GetLastError () returned 0x0 [0092.469] lstrlenA (lpString="ArRARNMKU") returned 9 [0092.470] RtlMoveMemory (in: Destination=0x650cb8, Source=0x6a165a0, Length=0xa | out: Destination=0x650cb8) [0092.488] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x2fe574 | out: pFixedInfo=0x0, pOutBufLen=0x2fe574) returned 0x6f [0092.497] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6b3a08 [0092.497] GetLastError () returned 0x0 [0092.497] GetNetworkParams (in: pFixedInfo=0x6b3a08, pOutBufLen=0x2fe574 | out: pFixedInfo=0x6b3a08, pOutBufLen=0x2fe574) returned 0x0 [0092.505] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0092.505] GetLastError () returned 0x0 [0092.505] LocalFree (hMem=0x6b3a08) returned 0x0 [0092.505] GetLastError () returned 0x0 [0092.505] GetAdaptersAddresses () returned 0x6f [0092.510] LocalAlloc (uFlags=0x0, uBytes=0xad4) returned 0x6bc6f8 [0092.510] GetLastError () returned 0x0 [0092.510] GetAdaptersAddresses () returned 0x0 [0092.517] LocalFree (hMem=0x6bc6f8) returned 0x0 [0092.517] GetLastError () returned 0x0 [0092.517] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x2fe634 | out: AdapterInfo=0x0, SizePointer=0x2fe634) returned 0x6f [0092.526] LocalAlloc (uFlags=0x0, uBytes=0x280) returned 0x6b3a08 [0092.526] GetLastError () returned 0x0 [0092.526] GetAdaptersInfo (in: AdapterInfo=0x6b3a08, SizePointer=0x2fe634 | out: AdapterInfo=0x6b3a08, SizePointer=0x2fe634) returned 0x0 [0092.529] inet_addr (cp="192.168.0.219") returned 0xdb00a8c0 [0092.529] GetLastError () returned 0x0 [0092.529] inet_addr (cp="255.255.255.0") returned 0xffffff [0092.529] GetLastError () returned 0x0 [0092.532] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0092.532] GetLastError () returned 0x0 [0092.533] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0092.533] GetLastError () returned 0x0 [0092.535] GetIfEntry (in: pIfRow=0x68b9a8 | out: pIfRow=0x68b9a8) returned 0x0 [0092.536] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x2fe3a8 | out: pPerAdapterInfo=0x0, pOutBufLen=0x2fe3a8) returned 0x6f [0092.543] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x65ad88 [0092.543] GetLastError () returned 0x0 [0092.543] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x65ad88, pOutBufLen=0x2fe3a8 | out: pPerAdapterInfo=0x65ad88, pOutBufLen=0x2fe3a8) returned 0x0 [0092.550] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0092.550] GetLastError () returned 0x0 [0092.550] LocalFree (hMem=0x65ad88) returned 0x0 [0092.550] GetLastError () returned 0x0 [0092.551] LocalFree (hMem=0x6b3a08) returned 0x0 [0092.551] GetLastError () returned 0x0 [0092.580] CreateBindCtx (in: reserved=0x0, ppbc=0x2fe68c | out: ppbc=0x2fe68c*=0x65c998) returned 0x0 [0092.580] IUnknown:QueryInterface (in: This=0x65c998, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf34 | out: ppvObject=0x2fdf34*=0x65c998) returned 0x0 [0092.580] IUnknown:QueryInterface (in: This=0x65c998, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fdef0 | out: ppvObject=0x2fdef0*=0x0) returned 0x80004002 [0092.581] IUnknown:QueryInterface (in: This=0x65c998, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fdde4 | out: ppvObject=0x2fdde4*=0x0) returned 0x80004002 [0092.581] IUnknown:AddRef (This=0x65c998) returned 0x3 [0092.581] CoGetContextToken (in: pToken=0x2fdd7c | out: pToken=0x2fdd7c) returned 0x0 [0092.581] CoGetContextToken (in: pToken=0x2fdd40 | out: pToken=0x2fdd40) returned 0x0 [0092.581] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd74 | out: ppvObject=0x2fdd74*=0x6484cc) returned 0x0 [0092.581] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdda4 | out: pAptType=0x2fdda4*=3) returned 0x0 [0092.582] IUnknown:Release (This=0x6484cc) returned 0x1 [0092.582] IUnknown:QueryInterface (in: This=0x65c998, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd64 | out: ppvObject=0x2fdd64*=0x0) returned 0x80004002 [0092.582] CoGetContextToken (in: pToken=0x2fdd74 | out: pToken=0x2fdd74) returned 0x0 [0092.582] IUnknown:AddRef (This=0x65c998) returned 0x4 [0092.582] IUnknown:QueryInterface (in: This=0x65c998, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdde8 | out: ppvObject=0x2fdde8*=0x0) returned 0x80004002 [0092.582] IUnknown:Release (This=0x65c998) returned 0x3 [0092.582] IUnknown:Release (This=0x65c998) returned 0x2 [0092.582] CoGetContextToken (in: pToken=0x2fe1e8 | out: pToken=0x2fe1e8) returned 0x0 [0092.582] CoGetContextToken (in: pToken=0x2fe1a8 | out: pToken=0x2fe1a8) returned 0x0 [0092.582] IUnknown:AddRef (This=0x65c998) returned 0x3 [0092.582] IUnknown:QueryInterface (in: This=0x65c998, riid=0x2fe224*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe220 | out: ppvObject=0x2fe220*=0x65c998) returned 0x0 [0092.582] IUnknown:Release (This=0x65c998) returned 0x3 [0092.583] IUnknown:Release (This=0x65c998) returned 0x2 [0092.583] IUnknown:Release (This=0x65c998) returned 0x1 [0092.584] CoGetContextToken (in: pToken=0x2fe24c | out: pToken=0x2fe24c) returned 0x0 [0092.585] CoGetContextToken (in: pToken=0x2fe20c | out: pToken=0x2fe20c) returned 0x0 [0092.585] IUnknown:AddRef (This=0x65c998) returned 0x2 [0092.585] IUnknown:QueryInterface (in: This=0x65c998, riid=0x2fe288*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe284 | out: ppvObject=0x2fe284*=0x65c998) returned 0x0 [0092.585] IUnknown:Release (This=0x65c998) returned 0x2 [0092.585] IUnknown:AddRef (This=0x65c998) returned 0x3 [0092.585] MkParseDisplayName (in: pbc=0x65c998, szUserName="winmgmts:", pchEaten=0x2fe718, ppmk=0x2fe65c | out: pchEaten=0x2fe718, ppmk=0x2fe65c*=0x6b4160) returned 0x0 [0092.735] DllGetClassObject (in: rclsid=0x6983e8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x2fe290*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x2fd948 | out: ppv=0x2fd948*=0x0) returned 0x80004002 [0092.735] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125ac8 [0092.735] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.735] DllGetClassObject (in: rclsid=0x6983e8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x772fee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x2fe450 | out: ppv=0x2fe450*=0x7125ac8) returned 0x0 [0092.735] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125ac8 [0092.736] WinMGMTS:IClassFactory:CreateInstance (in: This=0x7125ac8, pUnkOuter=0x0, riid=0x772ff084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe3fc | out: ppvObject=0x2fe3fc*=0x7110bb0) returned 0x0 [0092.736] GetVersionExW (in: lpVersionInformation=0x2fe248*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x4, dwMinorVersion=0x36b7, dwBuildNumber=0x3, dwPlatformId=0x2fe2ac, szCSDVersion="\x5bae\x777f\x08\xc015") | out: lpVersionInformation=0x2fe248*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0092.736] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x2fe23c | out: phkResult=0x2fe23c*=0x3b0) returned 0x0 [0092.736] RegQueryValueExW (in: hKey=0x3b0, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x2fe244, lpcbData=0x2fe240*=0x4 | out: lpType=0x0, lpData=0x2fe244*=0x3, lpcbData=0x2fe240*=0x4) returned 0x0 [0092.736] RegCloseKey (hKey=0x3b0) returned 0x0 [0092.736] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125c20 [0092.736] GetSystemDirectoryW (in: lpBuffer=0x7125c20, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0092.736] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x76f70000 [0092.736] GetProcAddress (hModule=0x76f70000, lpProcName="DuplicateTokenEx") returned 0x76f7ca24 [0092.737] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.737] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125c20 [0092.737] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7110bb0 [0092.737] WinMGMTS:IUnknown:Release (This=0x7125ac8) returned 0x0 [0092.737] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.737] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x7110bb0, pbc=0x65c998, pszDisplayName="winmgmts:", pchEaten=0x2fe614, ppmkOut=0x2fe618 | out: pchEaten=0x2fe614*=0x9, ppmkOut=0x2fe618*=0x6b4160) returned 0x0 [0092.737] _wcsnicmp (_String1="winmgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0092.744] IBindCtx:GetObjectParam (in: This=0x65c998, pszKey="WmiObject", ppunk=0x2fe51c | out: ppunk=0x2fe51c*=0x0) returned 0x80004005 [0092.744] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125ac8 [0092.744] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123 [0092.744] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125c48 [0092.744] CoCreateInstance (in: rclsid=0x5fb442b0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x5fb442a0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x7125c60 | out: ppv=0x7125c60*=0x7125cc8) returned 0x0 [0092.744] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125cd8 [0092.744] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125d40 [0092.744] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125da0 [0092.744] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0092.744] GetCurrentThreadId () returned 0x2c8 [0092.745] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91 [0092.745] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0092.745] GetCurrentThreadId () returned 0x2c8 [0092.745] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x2fe404 | out: phkResult=0x2fe404*=0x3b0) returned 0x0 [0092.745] RegQueryValueExW (in: hKey=0x3b0, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x2fe40c*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x2fe40c*=0x16) returned 0x0 [0092.745] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125dc0 [0092.745] RegQueryValueExW (in: hKey=0x3b0, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x7125dc0, lpcbData=0x2fe40c*=0x16 | out: lpType=0x0, lpData=0x7125dc0*=0x72, lpcbData=0x2fe40c*=0x16) returned 0x0 [0092.745] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125de0 [0092.745] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.745] RegCloseKey (hKey=0x3b0) returned 0x0 [0092.745] CoCreateInstance (in: rclsid=0x5fb453b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x5fb450dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x2fe438 | out: ppv=0x2fe438*=0x7125e00) returned 0x0 [0092.745] SysStringLen (param_1=".") returned 0x1 [0092.745] WbemDefPath:IWbemPath:SetServer (This=0x7125e00, Name=".") returned 0x0 [0092.745] CoCreateInstance (in: rclsid=0x5fb453b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x5fb450dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x2fe3f0 | out: ppv=0x2fe3f0*=0x7125e98) returned 0x0 [0092.745] CoCreateInstance (in: rclsid=0x5fb453b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x5fb450dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x2fe394 | out: ppv=0x2fe394*=0x7125f30) returned 0x0 [0092.745] WbemDefPath:IWbemPath:SetText (This=0x7125f30, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0092.745] WbemDefPath:IUnknown:Release (This=0x7125f30) returned 0x0 [0092.745] SysStringLen (param_1="root\\cimv2") returned 0xa [0092.745] WbemDefPath:IWbemPath:SetText (This=0x7125e98, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0092.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7125e98, puCount=0x2fe400 | out: puCount=0x2fe400*=0x2) returned 0x0 [0092.745] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x7125e00) returned 0x0 [0092.745] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x7125e98, uIndex=0x0, puNameBufLength=0x2fe3c8*=0x0, pName=0x0 | out: puNameBufLength=0x2fe3c8*=0x5, pName=0x0) returned 0x0 [0092.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126840 [0092.746] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x7125e98, uIndex=0x0, puNameBufLength=0x2fe3c8*=0x5, pName="\x05ଁ㳬ࠀጨ" | out: puNameBufLength=0x2fe3c8*=0x5, pName="root") returned 0x0 [0092.746] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.746] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x7125e00, uIndex=0x0, pszName="root") returned 0x0 [0092.746] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x7125e98, uIndex=0x1, puNameBufLength=0x2fe3c8*=0x0, pName=0x0 | out: puNameBufLength=0x2fe3c8*=0x6, pName=0x0) returned 0x0 [0092.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126870 [0092.746] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x7125e98, uIndex=0x1, puNameBufLength=0x2fe3c8*=0x6, pName="\x0bܑÄܑ" | out: puNameBufLength=0x2fe3c8*=0x6, pName="cimv2") returned 0x0 [0092.746] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.746] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x7125e00, uIndex=0x1, pszName="cimv2") returned 0x0 [0092.746] WbemDefPath:IUnknown:Release (This=0x7125e98) returned 0x0 [0092.746] WbemDefPath:IWbemPath:GetText (in: This=0x7125e00, lFlags=4, puBuffLength=0x2fe41c*=0x0, pszText=0x0 | out: puBuffLength=0x2fe41c*=0xf, pszText=0x0) returned 0x0 [0092.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71267c8 [0092.746] WbemDefPath:IWbemPath:GetText (in: This=0x7125e00, lFlags=4, puBuffLength=0x2fe41c*=0xf, pszText="\x5e98\x712\x5dc0\x712\x32" | out: puBuffLength=0x2fe41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0092.746] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.746] WbemDefPath:IUnknown:Release (This=0x7125e00) returned 0x0 [0092.746] WbemLocator:IWbemLocator:ConnectServer (in: This=0x7125cc8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x2fe4a4 | out: ppNamespace=0x2fe4a4*=0x7125e44) returned 0x0 [0092.751] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125e58 [0092.751] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71267c8 [0092.751] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125ec8 [0092.751] WbemLocator:IUnknown:QueryInterface (in: This=0x7125e44, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe374 | out: ppvObject=0x2fe374*=0x68a574) returned 0x0 [0092.752] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x68a574, pProxy=0x7125e44, pAuthnSvc=0x2fe364, pAuthzSvc=0x2fe368, pServerPrincName=0x0, pAuthnLevel=0x2fe390, pImpLevel=0x2fe38c, pAuthInfo=0x0, pCapabilites=0x2fe37c | out: pAuthnSvc=0x2fe364*=0xa, pAuthzSvc=0x2fe368*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fe390*=0x6, pImpLevel=0x2fe38c*=0x2, pAuthInfo=0x0, pCapabilites=0x2fe37c*=0x1) returned 0x0 [0092.752] WbemLocator:IUnknown:Release (This=0x68a574) returned 0x1 [0092.752] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0092.752] GetCurrentThreadId () returned 0x2c8 [0092.752] WbemLocator:IUnknown:QueryInterface (in: This=0x7125e44, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe3a4 | out: ppvObject=0x2fe3a4*=0x68a574) returned 0x0 [0092.753] WbemLocator:IClientSecurity:CopyProxy (in: This=0x68a574, pProxy=0x7125e44, ppCopy=0x2fe3a8 | out: ppCopy=0x2fe3a8*=0x7126c6c) returned 0x0 [0092.753] WbemLocator:IUnknown:QueryInterface (in: This=0x7126c6c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2c0 | out: ppvObject=0x2fe2c0*=0x68a574) returned 0x0 [0092.753] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x68a574, pProxy=0x7126c6c, pAuthnSvc=0x2fe2e4, pAuthzSvc=0x2fe2d4, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fe2e4*=0xa, pAuthzSvc=0x2fe2d4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0092.753] WbemLocator:IUnknown:Release (This=0x68a574) returned 0x3 [0092.753] WbemLocator:IUnknown:QueryInterface (in: This=0x7126c6c, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe298 | out: ppvObject=0x2fe298*=0x68a594) returned 0x0 [0092.753] WbemLocator:IUnknown:QueryInterface (in: This=0x7126c6c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe29c | out: ppvObject=0x2fe29c*=0x68a574) returned 0x0 [0092.753] WbemLocator:IClientSecurity:SetBlanket (This=0x68a574, pProxy=0x7126c6c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0092.753] WbemLocator:IUnknown:Release (This=0x68a574) returned 0x4 [0092.753] WbemLocator:IUnknown:Release (This=0x68a594) returned 0x3 [0092.753] WbemLocator:IUnknown:Release (This=0x68a574) returned 0x2 [0092.753] WbemLocator:IUnknown:AddRef (This=0x7126c6c) returned 0x3 [0092.753] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126c80 [0092.753] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126000 [0092.754] WbemLocator:IUnknown:Release (This=0x7125e44) returned 0x2 [0092.754] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0092.754] GetCurrentThreadId () returned 0x2c8 [0092.754] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0092.754] GetCurrentThreadId () returned 0x2c8 [0092.754] WbemLocator:IUnknown:QueryInterface (in: This=0x7126c6c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe468 | out: ppvObject=0x2fe468*=0x68a574) returned 0x0 [0092.754] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x68a574, pProxy=0x7126c6c, pAuthnSvc=0x2fe458, pAuthzSvc=0x2fe45c, pServerPrincName=0x0, pAuthnLevel=0x2fe488, pImpLevel=0x2fe48c, pAuthInfo=0x0, pCapabilites=0x2fe470 | out: pAuthnSvc=0x2fe458*=0xa, pAuthzSvc=0x2fe45c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fe488*=0x6, pImpLevel=0x2fe48c*=0x3, pAuthInfo=0x0, pCapabilites=0x2fe470*=0x20) returned 0x0 [0092.754] WbemLocator:IUnknown:Release (This=0x68a574) returned 0x2 [0092.754] CreatePointerMoniker (in: punk=0x7125e58, ppmk=0x2fe618 | out: ppmk=0x2fe618*=0x6b4160) returned 0x0 [0092.754] IUnknown:AddRef (This=0x7125e58) returned 0x2 [0092.754] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.755] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.755] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.755] WbemLocator:IUnknown:Release (This=0x7125cc8) returned 0x0 [0092.755] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.755] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.755] WinMGMTS:IUnknown:Release (This=0x7110bb0) returned 0x0 [0092.755] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0092.757] IUnknown:QueryInterface (in: This=0x6b4160, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf0c | out: ppvObject=0x2fdf0c*=0x6b4160) returned 0x0 [0092.757] IUnknown:QueryInterface (in: This=0x6b4160, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fdec8 | out: ppvObject=0x2fdec8*=0x0) returned 0x80004002 [0092.757] IUnknown:QueryInterface (in: This=0x6b4160, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fddbc | out: ppvObject=0x2fddbc*=0x0) returned 0x80004002 [0092.757] IUnknown:AddRef (This=0x6b4160) returned 0x3 [0092.758] CoGetContextToken (in: pToken=0x2fdd54 | out: pToken=0x2fdd54) returned 0x0 [0092.758] CoGetContextToken (in: pToken=0x2fdd18 | out: pToken=0x2fdd18) returned 0x0 [0092.758] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd4c | out: ppvObject=0x2fdd4c*=0x6484cc) returned 0x0 [0092.758] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd7c | out: pAptType=0x2fdd7c*=3) returned 0x0 [0092.758] IUnknown:Release (This=0x6484cc) returned 0x1 [0092.758] IUnknown:QueryInterface (in: This=0x6b4160, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd3c | out: ppvObject=0x2fdd3c*=0x6b4174) returned 0x0 [0092.758] IMarshal:GetUnmarshalClass (in: This=0x6b4174, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fdd44 | out: pCid=0x2fdd44*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0092.758] IUnknown:Release (This=0x6b4174) returned 0x3 [0092.758] CoGetContextToken (in: pToken=0x2fdd4c | out: pToken=0x2fdd4c) returned 0x0 [0092.758] IUnknown:AddRef (This=0x6b4160) returned 0x4 [0092.758] IUnknown:QueryInterface (in: This=0x6b4160, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fddc0 | out: ppvObject=0x2fddc0*=0x0) returned 0x80004002 [0092.759] IUnknown:Release (This=0x6b4160) returned 0x3 [0092.759] IUnknown:Release (This=0x6b4160) returned 0x2 [0092.759] CoGetContextToken (in: pToken=0x2fe1c0 | out: pToken=0x2fe1c0) returned 0x0 [0092.760] CoGetContextToken (in: pToken=0x2fe180 | out: pToken=0x2fe180) returned 0x0 [0092.760] IUnknown:AddRef (This=0x6b4160) returned 0x3 [0092.760] IUnknown:QueryInterface (in: This=0x6b4160, riid=0x2fe1fc*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe1f8 | out: ppvObject=0x2fe1f8*=0x6b4160) returned 0x0 [0092.760] IUnknown:Release (This=0x6b4160) returned 0x3 [0092.760] IUnknown:Release (This=0x6b4160) returned 0x2 [0092.760] IUnknown:Release (This=0x6b4160) returned 0x1 [0092.760] IUnknown:Release (This=0x65c998) returned 0x2 [0092.761] CoGetContextToken (in: pToken=0x2fe24c | out: pToken=0x2fe24c) returned 0x0 [0092.761] CoGetContextToken (in: pToken=0x2fe20c | out: pToken=0x2fe20c) returned 0x0 [0092.761] IUnknown:AddRef (This=0x6b4160) returned 0x2 [0092.761] IUnknown:QueryInterface (in: This=0x6b4160, riid=0x2fe288*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe284 | out: ppvObject=0x2fe284*=0x6b4160) returned 0x0 [0092.761] IUnknown:Release (This=0x6b4160) returned 0x2 [0092.761] IUnknown:AddRef (This=0x6b4160) returned 0x3 [0092.761] BindMoniker (in: pmk=0x6b4160, grfOpt=0x0, iidResult=0x1bf6614*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x2fe65c | out: ppvResult=0x2fe65c*=0x7125e58) returned 0x0 [0092.761] IUnknown:QueryInterface (in: This=0x7125e58, riid=0x1bf6614*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe65c | out: ppvObject=0x2fe65c*=0x7125e58) returned 0x0 [0092.763] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x2fdd84*=0x0 | out: pptlib=0x2fdd84*=0x691658) returned 0x0 [0092.796] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x7125e9c, ppTInfo=0x7125e84 | out: ppTInfo=0x7125e84*=0x6b846c) returned 0x0 [0092.796] IUnknown:Release (This=0x691658) returned 0x1 [0092.796] IUnknown:AddRef (This=0x6b846c) returned 0x2 [0092.796] ITypeInfo:RemoteGetTypeAttr (in: This=0x6b846c, ppTypeAttr=0x2fddc8, pDummy=0xe54421ad | out: ppTypeAttr=0x2fddc8, pDummy=0xe54421ad) returned 0x0 [0092.797] ITypeInfo:LocalReleaseTypeAttr (This=0x6b846c) returned 0x65e738 [0092.797] IUnknown:Release (This=0x6b846c) returned 0x1 [0092.798] CoGetContextToken (in: pToken=0x2fdd54 | out: pToken=0x2fdd54) returned 0x0 [0092.798] CoGetContextToken (in: pToken=0x2fdd18 | out: pToken=0x2fdd18) returned 0x0 [0092.798] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd4c | out: ppvObject=0x2fdd4c*=0x6484cc) returned 0x0 [0092.798] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd7c | out: pAptType=0x2fdd7c*=3) returned 0x0 [0092.798] IUnknown:Release (This=0x6484cc) returned 0x1 [0092.798] CoGetContextToken (in: pToken=0x2fdd4c | out: pToken=0x2fdd4c) returned 0x0 [0092.798] IUnknown:Release (This=0x6b4160) returned 0x2 [0092.854] CoGetContextToken (in: pToken=0x2fe288 | out: pToken=0x2fe288) returned 0x0 [0092.855] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x2fe284*=0x0 | out: pptlib=0x2fe284*=0x691658) returned 0x0 [0092.856] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x7125e8c, ppTInfo=0x7125e80 | out: ppTInfo=0x7125e80*=0x6b8498) returned 0x0 [0092.856] IUnknown:Release (This=0x691658) returned 0x2 [0092.856] IUnknown:AddRef (This=0x6b8498) returned 0x2 [0092.856] DispGetIDsOfNames (in: ptinfo=0x6b8498, rgszNames=0x2fe2e0*="InstancesOf", cNames=0x1, rgdispid=0x2fe2d0 | out: rgdispid=0x2fe2d0*=5) returned 0x0 [0092.857] IUnknown:Release (This=0x6b8498) returned 0x1 [0092.858] IUnknown:AddRef (This=0x6b8498) returned 0x2 [0092.858] ITypeInfo:LocalInvoke (This=0x6b8498) returned 0x0 [0092.858] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0092.858] GetCurrentThreadId () returned 0x2c8 [0092.858] WbemLocator:IUnknown:AddRef (This=0x7126c6c) returned 0x3 [0092.858] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0092.858] GetCurrentThreadId () returned 0x2c8 [0092.858] IWbemServices:CreateInstanceEnum (in: This=0x7126c6c, strFilter="Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x2fdf2c | out: ppEnum=0x2fdf2c*=0x7125cd4) returned 0x0 [0092.862] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125d10 [0092.863] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125d70 [0092.863] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126ce0 [0092.863] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125fe0 [0092.863] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126d40 [0092.863] IUnknown:QueryInterface (in: This=0x7125cd4, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde44 | out: ppvObject=0x2fde44*=0x7125cd8) returned 0x0 [0092.863] IClientSecurity:QueryBlanket (in: This=0x7125cd8, pProxy=0x7125cd4, pAuthnSvc=0x2fde34, pAuthzSvc=0x2fde38, pServerPrincName=0x0, pAuthnLevel=0x2fde60, pImpLevel=0x2fde5c, pAuthInfo=0x0, pCapabilites=0x2fde4c | out: pAuthnSvc=0x2fde34*=0xa, pAuthzSvc=0x2fde38*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fde60*=0x6, pImpLevel=0x2fde5c*=0x2, pAuthInfo=0x0, pCapabilites=0x2fde4c*=0x1) returned 0x0 [0092.863] IUnknown:Release (This=0x7125cd8) returned 0x1 [0092.863] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0092.863] GetCurrentThreadId () returned 0x2c8 [0092.863] WbemLocator:IUnknown:QueryInterface (in: This=0x7126c6c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde28 | out: ppvObject=0x2fde28*=0x68a574) returned 0x0 [0092.863] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x68a574, pProxy=0x7126c6c, pAuthnSvc=0x2fde18, pAuthzSvc=0x2fde1c, pServerPrincName=0x0, pAuthnLevel=0x2fde48, pImpLevel=0x2fde4c, pAuthInfo=0x0, pCapabilites=0x2fde30 | out: pAuthnSvc=0x2fde18*=0xa, pAuthzSvc=0x2fde1c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fde48*=0x6, pImpLevel=0x2fde4c*=0x3, pAuthInfo=0x0, pCapabilites=0x2fde30*=0x20) returned 0x0 [0092.863] WbemLocator:IUnknown:Release (This=0x68a574) returned 0x3 [0092.863] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0092.863] GetCurrentThreadId () returned 0x2c8 [0092.863] WbemLocator:IUnknown:QueryInterface (in: This=0x7126c6c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde28 | out: ppvObject=0x2fde28*=0x68a574) returned 0x0 [0092.863] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x68a574, pProxy=0x7126c6c, pAuthnSvc=0x2fde18, pAuthzSvc=0x2fde1c, pServerPrincName=0x0, pAuthnLevel=0x2fde4c, pImpLevel=0x2fde48, pAuthInfo=0x0, pCapabilites=0x2fde30 | out: pAuthnSvc=0x2fde18*=0xa, pAuthzSvc=0x2fde1c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fde4c*=0x6, pImpLevel=0x2fde48*=0x3, pAuthInfo=0x0, pCapabilites=0x2fde30*=0x20) returned 0x0 [0092.863] WbemLocator:IUnknown:Release (This=0x68a574) returned 0x3 [0092.863] IUnknown:QueryInterface (in: This=0x7125cd4, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde74 | out: ppvObject=0x2fde74*=0x7125cd8) returned 0x0 [0092.864] IClientSecurity:CopyProxy (in: This=0x7125cd8, pProxy=0x7125cd4, ppCopy=0x2fde78 | out: ppCopy=0x2fde78*=0x7126e84) returned 0x0 [0092.864] IUnknown:QueryInterface (in: This=0x7126e84, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd90 | out: ppvObject=0x2fdd90*=0x7126e88) returned 0x0 [0092.864] IClientSecurity:QueryBlanket (in: This=0x7126e88, pProxy=0x7126e84, pAuthnSvc=0x2fddb4, pAuthzSvc=0x2fdda4, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fddb4*=0xa, pAuthzSvc=0x2fdda4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0092.864] IUnknown:Release (This=0x7126e88) returned 0x3 [0092.864] IUnknown:QueryInterface (in: This=0x7126e84, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd68 | out: ppvObject=0x2fdd68*=0x6b3b94) returned 0x0 [0092.864] IUnknown:QueryInterface (in: This=0x7126e84, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd6c | out: ppvObject=0x2fdd6c*=0x7126e88) returned 0x0 [0092.864] IClientSecurity:SetBlanket (This=0x7126e88, pProxy=0x7126e84, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0092.995] IUnknown:Release (This=0x7126e88) returned 0x4 [0092.995] WbemLocator:IUnknown:Release (This=0x6b3b94) returned 0x3 [0092.995] IUnknown:Release (This=0x7125cd8) returned 0x2 [0092.995] IUnknown:AddRef (This=0x7126e84) returned 0x3 [0092.995] IUnknown:Release (This=0x7125cd4) returned 0x2 [0092.995] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fdee4 | out: pperrinfo=0x2fdee4*=0x0) returned 0x1 [0092.995] WbemLocator:IUnknown:Release (This=0x7126c6c) returned 0x2 [0092.996] IUnknown:Release (This=0x6b8498) returned 0x1 [0092.997] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x2fdb80*=0x0 | out: pptlib=0x2fdb80*=0x691658) returned 0x0 [0092.999] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x7125d48, ppTInfo=0x7125d30 | out: ppTInfo=0x7125d30*=0x6b85a0) returned 0x0 [0092.999] IUnknown:Release (This=0x691658) returned 0x3 [0092.999] IUnknown:AddRef (This=0x6b85a0) returned 0x2 [0092.999] ITypeInfo:RemoteGetTypeAttr (in: This=0x6b85a0, ppTypeAttr=0x2fdbc4, pDummy=0xe54427a1 | out: ppTypeAttr=0x2fdbc4, pDummy=0xe54427a1) returned 0x0 [0092.999] ITypeInfo:LocalReleaseTypeAttr (This=0x6b85a0) returned 0x65e738 [0092.999] IUnknown:Release (This=0x6b85a0) returned 0x1 [0093.000] CoGetContextToken (in: pToken=0x2fdb50 | out: pToken=0x2fdb50) returned 0x0 [0093.000] CoGetContextToken (in: pToken=0x2fdb14 | out: pToken=0x2fdb14) returned 0x0 [0093.000] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdb48 | out: ppvObject=0x2fdb48*=0x6484cc) returned 0x0 [0093.000] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdb78 | out: pAptType=0x2fdb78*=3) returned 0x0 [0093.000] IUnknown:Release (This=0x6484cc) returned 0x1 [0093.000] CoGetContextToken (in: pToken=0x2fdb48 | out: pToken=0x2fdb48) returned 0x0 [0093.001] CoGetContextToken (in: pToken=0x2fe514 | out: pToken=0x2fe514) returned 0x0 [0093.001] CoGetContextToken (in: pToken=0x2fe4d4 | out: pToken=0x2fe4d4) returned 0x0 [0093.001] CoGetContextToken (in: pToken=0x2fe55c | out: pToken=0x2fe55c) returned 0x0 [0093.002] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x2fe55c*=0x0 | out: pptlib=0x2fe55c*=0x691658) returned 0x0 [0093.003] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x7125d38, ppTInfo=0x7125d2c | out: ppTInfo=0x7125d2c*=0x6b8548) returned 0x0 [0093.003] IUnknown:Release (This=0x691658) returned 0x4 [0093.003] IUnknown:AddRef (This=0x6b8548) returned 0x2 [0093.003] ITypeInfo:LocalInvoke (This=0x6b8548) returned 0x0 [0093.003] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0093.004] GetCurrentThreadId () returned 0x2c8 [0093.004] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126870 [0093.004] IUnknown:Release (This=0x6b8548) returned 0x1 [0093.004] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0093.627] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x66a1d0 [0093.627] GetLastError () returned 0x0 [0093.628] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x66a258 [0093.628] GetLastError () returned 0x0 [0093.949] CoGetContextToken (in: pToken=0x2fe41c | out: pToken=0x2fe41c) returned 0x0 [0094.048] CoGetContextToken (in: pToken=0x2fe048 | out: pToken=0x2fe048) returned 0x0 [0094.048] IUnknown:AddRef (This=0x6b8548) returned 0x2 [0094.048] ITypeInfo:LocalInvoke (This=0x6b8548) returned 0x0 [0094.048] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0094.048] GetCurrentThreadId () returned 0x2c8 [0094.048] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0094.049] GetCurrentThreadId () returned 0x2c8 [0094.049] IUnknown:AddRef (This=0x7126e84) returned 0x3 [0094.049] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0094.049] GetCurrentThreadId () returned 0x2c8 [0094.049] IEnumWbemClassObject:Clone (in: This=0x7126e84, ppEnum=0x2fe038 | out: ppEnum=0x2fe038*=0x7126f4c) returned 0x0 [0094.401] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126f88 [0094.402] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711cd90 [0094.402] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711cdf0 [0094.402] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126020 [0094.402] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711ce50 [0094.402] IUnknown:QueryInterface (in: This=0x7126f4c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf50 | out: ppvObject=0x2fdf50*=0x7126f50) returned 0x0 [0094.402] IClientSecurity:QueryBlanket (in: This=0x7126f50, pProxy=0x7126f4c, pAuthnSvc=0x2fdf40, pAuthzSvc=0x2fdf44, pServerPrincName=0x0, pAuthnLevel=0x2fdf6c, pImpLevel=0x2fdf68, pAuthInfo=0x0, pCapabilites=0x2fdf58 | out: pAuthnSvc=0x2fdf40*=0xa, pAuthzSvc=0x2fdf44*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf6c*=0x6, pImpLevel=0x2fdf68*=0x2, pAuthInfo=0x0, pCapabilites=0x2fdf58*=0x1) returned 0x0 [0094.402] IUnknown:Release (This=0x7126f50) returned 0x1 [0094.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0094.402] GetCurrentThreadId () returned 0x2c8 [0094.402] IUnknown:QueryInterface (in: This=0x7126e84, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf34 | out: ppvObject=0x2fdf34*=0x7126e88) returned 0x0 [0094.402] IClientSecurity:QueryBlanket (in: This=0x7126e88, pProxy=0x7126e84, pAuthnSvc=0x2fdf24, pAuthzSvc=0x2fdf28, pServerPrincName=0x0, pAuthnLevel=0x2fdf54, pImpLevel=0x2fdf58, pAuthInfo=0x0, pCapabilites=0x2fdf3c | out: pAuthnSvc=0x2fdf24*=0xa, pAuthzSvc=0x2fdf28*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf54*=0x6, pImpLevel=0x2fdf58*=0x3, pAuthInfo=0x0, pCapabilites=0x2fdf3c*=0x20) returned 0x0 [0094.402] IUnknown:Release (This=0x7126e88) returned 0x3 [0094.402] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0094.402] GetCurrentThreadId () returned 0x2c8 [0094.402] IUnknown:QueryInterface (in: This=0x7126e84, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf34 | out: ppvObject=0x2fdf34*=0x7126e88) returned 0x0 [0094.402] IClientSecurity:QueryBlanket (in: This=0x7126e88, pProxy=0x7126e84, pAuthnSvc=0x2fdf24, pAuthzSvc=0x2fdf28, pServerPrincName=0x0, pAuthnLevel=0x2fdf58, pImpLevel=0x2fdf54, pAuthInfo=0x0, pCapabilites=0x2fdf3c | out: pAuthnSvc=0x2fdf24*=0xa, pAuthzSvc=0x2fdf28*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf58*=0x6, pImpLevel=0x2fdf54*=0x3, pAuthInfo=0x0, pCapabilites=0x2fdf3c*=0x20) returned 0x0 [0094.402] IUnknown:Release (This=0x7126e88) returned 0x3 [0094.402] IUnknown:QueryInterface (in: This=0x7126f4c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf80 | out: ppvObject=0x2fdf80*=0x7126f50) returned 0x0 [0094.402] IClientSecurity:CopyProxy (in: This=0x7126f50, pProxy=0x7126f4c, ppCopy=0x2fdf84 | out: ppCopy=0x2fdf84*=0x711cf94) returned 0x0 [0094.403] IUnknown:QueryInterface (in: This=0x711cf94, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde9c | out: ppvObject=0x2fde9c*=0x711cf98) returned 0x0 [0094.403] IClientSecurity:QueryBlanket (in: This=0x711cf98, pProxy=0x711cf94, pAuthnSvc=0x2fdec0, pAuthzSvc=0x2fdeb0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fdec0*=0xa, pAuthzSvc=0x2fdeb0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0094.403] IUnknown:Release (This=0x711cf98) returned 0x3 [0094.403] IUnknown:QueryInterface (in: This=0x711cf94, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde74 | out: ppvObject=0x2fde74*=0x6c2d14) returned 0x0 [0094.403] IUnknown:QueryInterface (in: This=0x711cf94, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde78 | out: ppvObject=0x2fde78*=0x711cf98) returned 0x0 [0094.403] IClientSecurity:SetBlanket (This=0x711cf98, pProxy=0x711cf94, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0094.702] IUnknown:Release (This=0x711cf98) returned 0x4 [0094.702] WbemLocator:IUnknown:Release (This=0x6c2d14) returned 0x3 [0094.702] IUnknown:Release (This=0x7126f50) returned 0x2 [0094.702] IUnknown:AddRef (This=0x711cf94) returned 0x3 [0094.702] IUnknown:Release (This=0x7126f4c) returned 0x2 [0094.702] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fdff0 | out: pperrinfo=0x2fdff0*=0x0) returned 0x1 [0094.702] IUnknown:Release (This=0x7126e84) returned 0x2 [0094.702] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0094.702] GetCurrentThreadId () returned 0x2c8 [0094.702] IUnknown:AddRef (This=0x711cf94) returned 0x3 [0094.703] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0094.703] GetCurrentThreadId () returned 0x2c8 [0094.703] IEnumWbemClassObject:Reset (This=0x711cf94) returned 0x0 [0094.734] IUnknown:Release (This=0x711cf94) returned 0x2 [0094.734] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126870 [0094.734] IUnknown:Release (This=0x6b8548) returned 0x1 [0094.734] CoGetContextToken (in: pToken=0x2fdab0 | out: pToken=0x2fdab0) returned 0x0 [0094.734] CoGetContextToken (in: pToken=0x2fda74 | out: pToken=0x2fda74) returned 0x0 [0094.734] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdaa8 | out: ppvObject=0x2fdaa8*=0x6484cc) returned 0x0 [0094.734] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdad8 | out: pAptType=0x2fdad8*=3) returned 0x0 [0094.734] IUnknown:Release (This=0x6484cc) returned 0x1 [0094.735] CoGetContextToken (in: pToken=0x2fdaa8 | out: pToken=0x2fdaa8) returned 0x0 [0094.737] CoGetContextToken (in: pToken=0x2fe55c | out: pToken=0x2fe55c) returned 0x0 [0094.737] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0094.737] GetCurrentThreadId () returned 0x2c8 [0094.737] IUnknown:AddRef (This=0x711cf94) returned 0x3 [0094.737] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0094.737] GetCurrentThreadId () returned 0x2c8 [0094.737] IEnumWbemClassObject:Next (in: This=0x711cf94, lTimeout=-1, uCount=0x1, apObjects=0x2fe694, puReturned=0x2fe68c | out: apObjects=0x2fe694*=0x711cfd0, puReturned=0x2fe68c*=0x1) returned 0x0 [0096.302] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125f80 [0096.302] IUnknown:AddRef (This=0x711cfd0) returned 0x2 [0096.302] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7129248 [0096.302] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71292b8 [0096.302] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7129318 [0096.302] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126040 [0096.302] WbemLocator:IUnknown:AddRef (This=0x7126c6c) returned 0x3 [0096.302] IUnknown:AddRef (This=0x711cf94) returned 0x4 [0096.302] IUnknown:QueryInterface (in: This=0x711cf94, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe5f4 | out: ppvObject=0x2fe5f4*=0x711cf98) returned 0x0 [0096.302] IClientSecurity:QueryBlanket (in: This=0x711cf98, pProxy=0x711cf94, pAuthnSvc=0x2fe5e4, pAuthzSvc=0x2fe5e8, pServerPrincName=0x0, pAuthnLevel=0x2fe604, pImpLevel=0x2fe610, pAuthInfo=0x0, pCapabilites=0x2fe5fc | out: pAuthnSvc=0x2fe5e4*=0xa, pAuthzSvc=0x2fe5e8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fe604*=0x6, pImpLevel=0x2fe610*=0x3, pAuthInfo=0x0, pCapabilites=0x2fe5fc*=0x20) returned 0x0 [0096.302] IUnknown:Release (This=0x711cf98) returned 0x4 [0096.302] WbemLocator:IUnknown:Release (This=0x7126c6c) returned 0x2 [0096.302] WbemLocator:IUnknown:AddRef (This=0x7126c6c) returned 0x3 [0096.302] IUnknown:Release (This=0x711cf94) returned 0x3 [0096.302] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0096.303] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711c060 [0096.303] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126060 [0096.303] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7129378 [0096.303] IUnknown:AddRef (This=0x711cfd0) returned 0x3 [0096.303] IUnknown:Release (This=0x711cfd0) returned 0x2 [0096.303] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fe648 | out: pperrinfo=0x2fe648*=0x0) returned 0x1 [0096.303] IUnknown:Release (This=0x711cf94) returned 0x2 [0096.303] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fe68c | out: pperrinfo=0x2fe68c*=0x0) returned 0x1 [0096.306] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x2fdefc*=0x0 | out: pptlib=0x2fdefc*=0x691658) returned 0x0 [0096.307] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x5fb570c4, ppTInfo=0x711c07c | out: ppTInfo=0x711c07c*=0x6b85cc) returned 0x0 [0096.307] IUnknown:Release (This=0x691658) returned 0x5 [0096.307] IUnknown:AddRef (This=0x6b85cc) returned 0x2 [0096.308] ITypeInfo:RemoteGetTypeAttr (in: This=0x6b85cc, ppTypeAttr=0x2fdf50, pDummy=0xe5442315 | out: ppTypeAttr=0x2fdf50, pDummy=0xe5442315) returned 0x0 [0096.308] ITypeInfo:LocalReleaseTypeAttr (This=0x6b85cc) returned 0x65e738 [0096.308] IUnknown:Release (This=0x6b85cc) returned 0x1 [0096.308] CoGetContextToken (in: pToken=0x2fdedc | out: pToken=0x2fdedc) returned 0x0 [0096.308] CoGetContextToken (in: pToken=0x2fdea0 | out: pToken=0x2fdea0) returned 0x0 [0096.308] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fded4 | out: ppvObject=0x2fded4*=0x6484cc) returned 0x0 [0096.308] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdf04 | out: pAptType=0x2fdf04*=3) returned 0x0 [0096.308] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.309] CoGetContextToken (in: pToken=0x2fded4 | out: pToken=0x2fded4) returned 0x0 [0096.314] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x2fe288*=0x0 | out: pptlib=0x2fe288*=0x691658) returned 0x0 [0096.315] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x5fb455e4, ppTInfo=0x711c078 | out: ppTInfo=0x711c078*=0x6b85f8) returned 0x0 [0096.315] IUnknown:Release (This=0x691658) returned 0x6 [0096.315] IUnknown:AddRef (This=0x6b85f8) returned 0x2 [0096.315] DispGetIDsOfNames (in: ptinfo=0x6b85f8, rgszNames=0x2fe300*="Name", cNames=0x1, rgdispid=0x2fe2f0 | out: rgdispid=0x2fe2f0*=-1) returned 0x80020006 [0096.317] IUnknown:AddRef (This=0x711cfd0) returned 0x3 [0096.317] IWbemClassObject:Get (in: This=0x711cfd0, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x2fe210*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x2fe210*=0) returned 0x0 [0096.317] IUnknown:Release (This=0x711cfd0) returned 0x2 [0096.317] SysStringLen (param_1="Name") returned 0x4 [0096.317] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71293a0 [0096.317] SysStringLen (param_1="Name") returned 0x4 [0096.317] IUnknown:Release (This=0x6b85f8) returned 0x1 [0096.317] IUnknown:AddRef (This=0x6b85f8) returned 0x2 [0096.317] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.317] GetCurrentThreadId () returned 0x2c8 [0096.317] IWbemClassObject:Get (in: This=0x711cfd0, wszName="Name", lFlags=0, pVal=0x2fe098*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fe0d0, varVal2=0x5fb42d81), pType=0x2fe0a8*=1605643654, plFlavor=0x0 | out: pVal=0x2fe098*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel (R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x5fb42d81), pType=0x2fe0a8*=8, plFlavor=0x0) returned 0x0 [0096.317] IUnknown:Release (This=0x6b85f8) returned 0x1 [0096.318] SysStringLen (param_1="Intel (R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x28 [0096.378] GlobalMemoryStatusEx (in: lpBuffer=0x1c11ea0 | out: lpBuffer=0x1c11ea0) returned 1 [0096.378] GetLastError () returned 0x0 [0096.385] VarDecCmp (pdecLeft=0x2fe670, pdecRight=0x2fe660) returned 0x2 [0096.386] VarDecRound (in: pdecIn=0x2fe670, cDecimals=2, pdecResult=0x2fe6d0 | out: pdecResult=0x2fe6d0) returned 0x0 [0096.386] VarDecCmp (pdecLeft=0x2fe670, pdecRight=0x2fe660) returned 0x2 [0096.386] VarDecRound (in: pdecIn=0x2fe670, cDecimals=2, pdecResult=0x2fe6d0 | out: pdecResult=0x2fe6d0) returned 0x0 [0096.386] VarDecCmp (pdecLeft=0x2fe670, pdecRight=0x2fe660) returned 0x2 [0096.386] VarDecRound (in: pdecIn=0x2fe670, cDecimals=2, pdecResult=0x2fe6d0 | out: pdecResult=0x2fe6d0) returned 0x0 [0096.394] GetLocaleInfoA (in: Locale=0x400, LCType=0x1002, lpLCData=0x650cf0, cchData=256 | out: lpLCData="United States") returned 14 [0096.397] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd5c | out: ppvObject=0x2fdd5c*=0x6484cc) returned 0x0 [0096.397] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd8c | out: pAptType=0x2fdd8c*=3) returned 0x0 [0096.397] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.397] IUnknown:QueryInterface (in: This=0x65ca18, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd4c | out: ppvObject=0x2fdd4c*=0x0) returned 0x80004002 [0096.397] CoGetContextToken (in: pToken=0x2fdd5c | out: pToken=0x2fdd5c) returned 0x0 [0096.397] IUnknown:AddRef (This=0x65ca18) returned 0x4 [0096.398] IUnknown:QueryInterface (in: This=0x65ca18, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fddd0 | out: ppvObject=0x2fddd0*=0x0) returned 0x80004002 [0096.398] IUnknown:Release (This=0x65ca18) returned 0x3 [0096.398] MkParseDisplayName (in: pbc=0x65ca18, szUserName="winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\SecurityCenter2", pchEaten=0x2fe700, ppmk=0x2fe644 | out: pchEaten=0x2fe700, ppmk=0x2fe644*=0x6c50d0) returned 0x0 [0096.398] DllGetClassObject (in: rclsid=0x6983e8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x772ff084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x2fe5b4 | out: ppv=0x2fe5b4*=0x0) returned 0x80004002 [0096.398] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126888 [0096.398] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.398] DllGetClassObject (in: rclsid=0x6983e8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x772fee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x2fe438 | out: ppv=0x2fe438*=0x7126888) returned 0x0 [0096.398] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126888 [0096.399] WinMGMTS:IClassFactory:CreateInstance (in: This=0x7126888, pUnkOuter=0x0, riid=0x772ff084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe3e4 | out: ppvObject=0x2fe3e4*=0x7125dd0) returned 0x0 [0096.399] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7125dd0 [0096.399] WinMGMTS:IUnknown:Release (This=0x7126888) returned 0x0 [0096.399] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.399] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x7125dd0, pbc=0x65ca18, pszDisplayName="winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\SecurityCenter2", pchEaten=0x2fe5fc, ppmkOut=0x2fe600 | out: pchEaten=0x2fe5fc*=0x42, ppmkOut=0x2fe600*=0x6c50d0) returned 0x0 [0096.399] _wcsnicmp (_String1="winmgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0096.399] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126080 [0096.399] _wcsnicmp (_String1="{", _String2="{", _MaxCount=0x1) returned 0 [0096.399] _wcsnicmp (_String1="impersonationLevel=", _String2="authenticationLevel", _MaxCount=0x13) returned 8 [0096.399] _wcsnicmp (_String1="impersonationLevel", _String2="impersonationLevel", _MaxCount=0x12) returned 0 [0096.399] _wcsnicmp (_String1="=", _String2="=", _MaxCount=0x1) returned 0 [0096.399] _wcsnicmp (_String1="impersona", _String2="anonymous", _MaxCount=0x9) returned 8 [0096.399] _wcsnicmp (_String1="imperson", _String2="identify", _MaxCount=0x8) returned 9 [0096.399] _wcsnicmp (_String1="impersonate", _String2="impersonate", _MaxCount=0xb) returned 0 [0096.399] _wcsnicmp (_String1="}", _String2="}", _MaxCount=0x1) returned 0 [0096.399] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71293c8 [0096.399] CoCreateInstance (in: rclsid=0x5fb442b0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x5fb442a0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x71293e0 | out: ppv=0x71293e0*=0x711fa48) returned 0x0 [0096.399] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7129430 [0096.399] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7129498 [0096.399] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71260a0 [0096.399] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.399] GetCurrentThreadId () returned 0x2c8 [0096.400] WbemLocator:IWbemLocator:ConnectServer (in: This=0x711fa48, strNetworkResource="\\\\.\\root\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x2fe48c | out: ppNamespace=0x2fe48c*=0x71296dc) returned 0x0 [0096.406] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71296f0 [0096.406] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7129760 [0096.406] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71297c0 [0096.406] WbemLocator:IUnknown:QueryInterface (in: This=0x71296dc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe35c | out: ppvObject=0x2fe35c*=0x6c2fc4) returned 0x0 [0096.406] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c2fc4, pProxy=0x71296dc, pAuthnSvc=0x2fe34c, pAuthzSvc=0x2fe350, pServerPrincName=0x0, pAuthnLevel=0x2fe378, pImpLevel=0x2fe374, pAuthInfo=0x0, pCapabilites=0x2fe364 | out: pAuthnSvc=0x2fe34c*=0xa, pAuthzSvc=0x2fe350*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fe378*=0x6, pImpLevel=0x2fe374*=0x2, pAuthInfo=0x0, pCapabilites=0x2fe364*=0x1) returned 0x0 [0096.406] WbemLocator:IUnknown:Release (This=0x6c2fc4) returned 0x1 [0096.406] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.406] GetCurrentThreadId () returned 0x2c8 [0096.406] WbemLocator:IUnknown:QueryInterface (in: This=0x71296dc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe38c | out: ppvObject=0x2fe38c*=0x6c2fc4) returned 0x0 [0096.406] WbemLocator:IClientSecurity:CopyProxy (in: This=0x6c2fc4, pProxy=0x71296dc, ppCopy=0x2fe390 | out: ppCopy=0x2fe390*=0x71298bc) returned 0x0 [0096.406] WbemLocator:IUnknown:QueryInterface (in: This=0x71298bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2a8 | out: ppvObject=0x2fe2a8*=0x6c2fc4) returned 0x0 [0096.406] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c2fc4, pProxy=0x71298bc, pAuthnSvc=0x2fe2cc, pAuthzSvc=0x2fe2bc, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fe2cc*=0xa, pAuthzSvc=0x2fe2bc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0096.406] WbemLocator:IUnknown:Release (This=0x6c2fc4) returned 0x3 [0096.406] WbemLocator:IUnknown:QueryInterface (in: This=0x71298bc, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe280 | out: ppvObject=0x2fe280*=0x6c2fe4) returned 0x0 [0096.406] WbemLocator:IUnknown:QueryInterface (in: This=0x71298bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe284 | out: ppvObject=0x2fe284*=0x6c2fc4) returned 0x0 [0096.406] WbemLocator:IClientSecurity:SetBlanket (This=0x6c2fc4, pProxy=0x71298bc, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.406] WbemLocator:IUnknown:Release (This=0x6c2fc4) returned 0x4 [0096.406] WbemLocator:IUnknown:Release (This=0x6c2fe4) returned 0x3 [0096.406] WbemLocator:IUnknown:Release (This=0x6c2fc4) returned 0x2 [0096.407] WbemLocator:IUnknown:AddRef (This=0x71298bc) returned 0x3 [0096.407] WbemLocator:IUnknown:Release (This=0x71296dc) returned 0x2 [0096.407] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.407] GetCurrentThreadId () returned 0x2c8 [0096.407] WbemLocator:IUnknown:QueryInterface (in: This=0x71298bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe450 | out: ppvObject=0x2fe450*=0x6c2fc4) returned 0x0 [0096.407] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c2fc4, pProxy=0x71298bc, pAuthnSvc=0x2fe440, pAuthzSvc=0x2fe444, pServerPrincName=0x0, pAuthnLevel=0x2fe470, pImpLevel=0x2fe474, pAuthInfo=0x0, pCapabilites=0x2fe458 | out: pAuthnSvc=0x2fe440*=0xa, pAuthzSvc=0x2fe444*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fe470*=0x6, pImpLevel=0x2fe474*=0x3, pAuthInfo=0x0, pCapabilites=0x2fe458*=0x20) returned 0x0 [0096.407] WbemLocator:IUnknown:Release (This=0x6c2fc4) returned 0x2 [0096.407] WbemDefPath:IWbemPath:GetInfo (in: This=0x71294f8, uRequestedInfo=0x0, puResponse=0x2fe498 | out: puResponse=0x2fe498*=0x24e01) returned 0x0 [0096.407] WbemDefPath:IWbemPath:GetInfo (in: This=0x71294f8, uRequestedInfo=0x0, puResponse=0x2fe498 | out: puResponse=0x2fe498*=0x24e01) returned 0x0 [0096.407] CreatePointerMoniker (in: punk=0x71296f0, ppmk=0x2fe600 | out: ppmk=0x2fe600*=0x6c50d0) returned 0x0 [0096.407] IUnknown:AddRef (This=0x71296f0) returned 0x2 [0096.407] WbemDefPath:IUnknown:Release (This=0x71294f8) returned 0x0 [0096.407] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.407] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.407] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.407] WbemLocator:IUnknown:Release (This=0x711fa48) returned 0x0 [0096.407] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.408] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.408] WinMGMTS:IUnknown:Release (This=0x7125dd0) returned 0x0 [0096.408] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.408] IUnknown:QueryInterface (in: This=0x6c50d0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdef4 | out: ppvObject=0x2fdef4*=0x6c50d0) returned 0x0 [0096.408] IUnknown:QueryInterface (in: This=0x6c50d0, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fdeb0 | out: ppvObject=0x2fdeb0*=0x0) returned 0x80004002 [0096.408] IUnknown:QueryInterface (in: This=0x6c50d0, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fdda4 | out: ppvObject=0x2fdda4*=0x0) returned 0x80004002 [0096.408] IUnknown:AddRef (This=0x6c50d0) returned 0x3 [0096.408] CoGetContextToken (in: pToken=0x2fdd3c | out: pToken=0x2fdd3c) returned 0x0 [0096.408] CoGetContextToken (in: pToken=0x2fdd00 | out: pToken=0x2fdd00) returned 0x0 [0096.408] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd34 | out: ppvObject=0x2fdd34*=0x6484cc) returned 0x0 [0096.408] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd64 | out: pAptType=0x2fdd64*=3) returned 0x0 [0096.408] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.409] IUnknown:QueryInterface (in: This=0x6c50d0, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd24 | out: ppvObject=0x2fdd24*=0x6c50e4) returned 0x0 [0096.409] IMarshal:GetUnmarshalClass (in: This=0x6c50e4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fdd2c | out: pCid=0x2fdd2c*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0096.409] IUnknown:Release (This=0x6c50e4) returned 0x3 [0096.409] CoGetContextToken (in: pToken=0x2fdd34 | out: pToken=0x2fdd34) returned 0x0 [0096.409] IUnknown:AddRef (This=0x6c50d0) returned 0x4 [0096.409] IUnknown:QueryInterface (in: This=0x6c50d0, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdda8 | out: ppvObject=0x2fdda8*=0x0) returned 0x80004002 [0096.409] IUnknown:Release (This=0x6c50d0) returned 0x3 [0096.409] IUnknown:Release (This=0x6c50d0) returned 0x2 [0096.409] CoGetContextToken (in: pToken=0x2fe1a8 | out: pToken=0x2fe1a8) returned 0x0 [0096.409] CoGetContextToken (in: pToken=0x2fe168 | out: pToken=0x2fe168) returned 0x0 [0096.409] IUnknown:AddRef (This=0x6c50d0) returned 0x3 [0096.409] IUnknown:QueryInterface (in: This=0x6c50d0, riid=0x2fe1e4*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe1e0 | out: ppvObject=0x2fe1e0*=0x6c50d0) returned 0x0 [0096.409] IUnknown:Release (This=0x6c50d0) returned 0x3 [0096.409] IUnknown:Release (This=0x6c50d0) returned 0x2 [0096.410] IUnknown:Release (This=0x6c50d0) returned 0x1 [0096.410] IUnknown:Release (This=0x65ca18) returned 0x2 [0096.410] CoGetContextToken (in: pToken=0x2fe234 | out: pToken=0x2fe234) returned 0x0 [0096.410] CoGetContextToken (in: pToken=0x2fe1f4 | out: pToken=0x2fe1f4) returned 0x0 [0096.410] IUnknown:AddRef (This=0x6c50d0) returned 0x2 [0096.410] IUnknown:QueryInterface (in: This=0x6c50d0, riid=0x2fe270*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe26c | out: ppvObject=0x2fe26c*=0x6c50d0) returned 0x0 [0096.410] IUnknown:Release (This=0x6c50d0) returned 0x2 [0096.410] IUnknown:AddRef (This=0x6c50d0) returned 0x3 [0096.410] BindMoniker (in: pmk=0x6c50d0, grfOpt=0x0, iidResult=0x1bf6614*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x2fe644 | out: ppvResult=0x2fe644*=0x71296f0) returned 0x0 [0096.410] IUnknown:QueryInterface (in: This=0x71296f0, riid=0x1bf6614*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe644 | out: ppvObject=0x2fe644*=0x71296f0) returned 0x0 [0096.410] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x2fdd6c*=0x0 | out: pptlib=0x2fdd6c*=0x691658) returned 0x0 [0096.411] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x7129734, ppTInfo=0x712971c | out: ppTInfo=0x712971c*=0x6b846c) returned 0x0 [0096.411] IUnknown:Release (This=0x691658) returned 0x6 [0096.411] IUnknown:AddRef (This=0x6b846c) returned 0x3 [0096.412] ITypeInfo:RemoteGetTypeAttr (in: This=0x6b846c, ppTypeAttr=0x2fddb0, pDummy=0xe54421b5 | out: ppTypeAttr=0x2fddb0, pDummy=0xe54421b5) returned 0x0 [0096.412] ITypeInfo:LocalReleaseTypeAttr (This=0x6b846c) returned 0x6afad8 [0096.412] IUnknown:Release (This=0x6b846c) returned 0x2 [0096.412] CoGetContextToken (in: pToken=0x2fdd3c | out: pToken=0x2fdd3c) returned 0x0 [0096.412] CoGetContextToken (in: pToken=0x2fdd00 | out: pToken=0x2fdd00) returned 0x0 [0096.412] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd34 | out: ppvObject=0x2fdd34*=0x6484cc) returned 0x0 [0096.412] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd64 | out: pAptType=0x2fdd64*=3) returned 0x0 [0096.412] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.412] CoGetContextToken (in: pToken=0x2fdd34 | out: pToken=0x2fdd34) returned 0x0 [0096.413] IUnknown:Release (This=0x6c50d0) returned 0x2 [0096.413] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x2fe274*=0x0 | out: pptlib=0x2fe274*=0x691658) returned 0x0 [0096.414] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x7129724, ppTInfo=0x7129718 | out: ppTInfo=0x7129718*=0x6b8498) returned 0x0 [0096.414] IUnknown:Release (This=0x691658) returned 0x6 [0096.414] IUnknown:AddRef (This=0x6b8498) returned 0x3 [0096.414] DispGetIDsOfNames (in: ptinfo=0x6b8498, rgszNames=0x2fe2d0*="ExecQuery", cNames=0x1, rgdispid=0x2fe2c0 | out: rgdispid=0x2fe2c0*=9) returned 0x0 [0096.414] IUnknown:Release (This=0x6b8498) returned 0x2 [0096.414] IUnknown:AddRef (This=0x6b8498) returned 0x3 [0096.414] ITypeInfo:LocalInvoke (This=0x6b8498) returned 0x0 [0096.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.414] GetCurrentThreadId () returned 0x2c8 [0096.415] WbemLocator:IUnknown:AddRef (This=0x71298bc) returned 0x3 [0096.415] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.415] GetCurrentThreadId () returned 0x2c8 [0096.415] IWbemServices:ExecQuery (in: This=0x71298bc, strQueryLanguage="WQL", strQuery="Select * from AntiVirusProduct", lFlags=272, pCtx=0x0, ppEnum=0x2fdf18 | out: ppEnum=0x2fdf18*=0x7129454) returned 0x0 [0096.420] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7129490 [0096.420] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71294f0 [0096.420] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7129550 [0096.420] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126080 [0096.420] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71295b0 [0096.420] IUnknown:QueryInterface (in: This=0x7129454, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde30 | out: ppvObject=0x2fde30*=0x7129458) returned 0x0 [0096.420] IClientSecurity:QueryBlanket (in: This=0x7129458, pProxy=0x7129454, pAuthnSvc=0x2fde20, pAuthzSvc=0x2fde24, pServerPrincName=0x0, pAuthnLevel=0x2fde4c, pImpLevel=0x2fde48, pAuthInfo=0x0, pCapabilites=0x2fde38 | out: pAuthnSvc=0x2fde20*=0xa, pAuthzSvc=0x2fde24*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fde4c*=0x6, pImpLevel=0x2fde48*=0x2, pAuthInfo=0x0, pCapabilites=0x2fde38*=0x1) returned 0x0 [0096.420] IUnknown:Release (This=0x7129458) returned 0x1 [0096.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.421] GetCurrentThreadId () returned 0x2c8 [0096.421] WbemLocator:IUnknown:QueryInterface (in: This=0x71298bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde14 | out: ppvObject=0x2fde14*=0x6c2fc4) returned 0x0 [0096.421] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c2fc4, pProxy=0x71298bc, pAuthnSvc=0x2fde04, pAuthzSvc=0x2fde08, pServerPrincName=0x0, pAuthnLevel=0x2fde34, pImpLevel=0x2fde38, pAuthInfo=0x0, pCapabilites=0x2fde1c | out: pAuthnSvc=0x2fde04*=0xa, pAuthzSvc=0x2fde08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fde34*=0x6, pImpLevel=0x2fde38*=0x3, pAuthInfo=0x0, pCapabilites=0x2fde1c*=0x20) returned 0x0 [0096.421] WbemLocator:IUnknown:Release (This=0x6c2fc4) returned 0x3 [0096.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.421] GetCurrentThreadId () returned 0x2c8 [0096.421] WbemLocator:IUnknown:QueryInterface (in: This=0x71298bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde14 | out: ppvObject=0x2fde14*=0x6c2fc4) returned 0x0 [0096.421] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c2fc4, pProxy=0x71298bc, pAuthnSvc=0x2fde04, pAuthzSvc=0x2fde08, pServerPrincName=0x0, pAuthnLevel=0x2fde38, pImpLevel=0x2fde34, pAuthInfo=0x0, pCapabilites=0x2fde1c | out: pAuthnSvc=0x2fde04*=0xa, pAuthzSvc=0x2fde08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fde38*=0x6, pImpLevel=0x2fde34*=0x3, pAuthInfo=0x0, pCapabilites=0x2fde1c*=0x20) returned 0x0 [0096.421] WbemLocator:IUnknown:Release (This=0x6c2fc4) returned 0x3 [0096.421] IUnknown:QueryInterface (in: This=0x7129454, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde60 | out: ppvObject=0x2fde60*=0x7129458) returned 0x0 [0096.421] IClientSecurity:CopyProxy (in: This=0x7129458, pProxy=0x7129454, ppCopy=0x2fde64 | out: ppCopy=0x2fde64*=0x71299bc) returned 0x0 [0096.421] IUnknown:QueryInterface (in: This=0x71299bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd7c | out: ppvObject=0x2fdd7c*=0x71299c0) returned 0x0 [0096.421] IClientSecurity:QueryBlanket (in: This=0x71299c0, pProxy=0x71299bc, pAuthnSvc=0x2fdda0, pAuthzSvc=0x2fdd90, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fdda0*=0xa, pAuthzSvc=0x2fdd90*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0096.421] IUnknown:Release (This=0x71299c0) returned 0x3 [0096.421] IUnknown:QueryInterface (in: This=0x71299bc, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd54 | out: ppvObject=0x2fdd54*=0x6c2ef4) returned 0x0 [0096.421] IUnknown:QueryInterface (in: This=0x71299bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd58 | out: ppvObject=0x2fdd58*=0x71299c0) returned 0x0 [0096.421] IClientSecurity:SetBlanket (This=0x71299c0, pProxy=0x71299bc, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.422] IUnknown:Release (This=0x71299c0) returned 0x4 [0096.422] WbemLocator:IUnknown:Release (This=0x6c2ef4) returned 0x3 [0096.422] IUnknown:Release (This=0x7129458) returned 0x2 [0096.422] IUnknown:AddRef (This=0x71299bc) returned 0x3 [0096.422] IUnknown:Release (This=0x7129454) returned 0x2 [0096.422] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fded0 | out: pperrinfo=0x2fded0*=0x0) returned 0x1 [0096.423] WbemLocator:IUnknown:Release (This=0x71298bc) returned 0x2 [0096.423] IUnknown:Release (This=0x6b8498) returned 0x2 [0096.423] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x2fdb70*=0x0 | out: pptlib=0x2fdb70*=0x691658) returned 0x0 [0096.424] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x71294c8, ppTInfo=0x71294b0 | out: ppTInfo=0x71294b0*=0x6b85a0) returned 0x0 [0096.424] IUnknown:Release (This=0x691658) returned 0x6 [0096.424] IUnknown:AddRef (This=0x6b85a0) returned 0x3 [0096.424] ITypeInfo:RemoteGetTypeAttr (in: This=0x6b85a0, ppTypeAttr=0x2fdbb4, pDummy=0xe54427b1 | out: ppTypeAttr=0x2fdbb4, pDummy=0xe54427b1) returned 0x0 [0096.424] ITypeInfo:LocalReleaseTypeAttr (This=0x6b85a0) returned 0x6afa30 [0096.424] IUnknown:Release (This=0x6b85a0) returned 0x2 [0096.425] CoGetContextToken (in: pToken=0x2fdb40 | out: pToken=0x2fdb40) returned 0x0 [0096.425] CoGetContextToken (in: pToken=0x2fdb04 | out: pToken=0x2fdb04) returned 0x0 [0096.425] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdb38 | out: ppvObject=0x2fdb38*=0x6484cc) returned 0x0 [0096.425] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdb68 | out: pAptType=0x2fdb68*=3) returned 0x0 [0096.425] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.425] CoGetContextToken (in: pToken=0x2fdb38 | out: pToken=0x2fdb38) returned 0x0 [0096.425] CoGetContextToken (in: pToken=0x2fe4fc | out: pToken=0x2fe4fc) returned 0x0 [0096.425] CoGetContextToken (in: pToken=0x2fe4bc | out: pToken=0x2fe4bc) returned 0x0 [0096.426] CoGetContextToken (in: pToken=0x2fe544 | out: pToken=0x2fe544) returned 0x0 [0096.426] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x2fe544*=0x0 | out: pptlib=0x2fe544*=0x691658) returned 0x0 [0096.427] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x71294b8, ppTInfo=0x71294ac | out: ppTInfo=0x71294ac*=0x6b8548) returned 0x0 [0096.427] IUnknown:Release (This=0x691658) returned 0x6 [0096.427] IUnknown:AddRef (This=0x6b8548) returned 0x3 [0096.427] ITypeInfo:LocalInvoke (This=0x6b8548) returned 0x0 [0096.427] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.427] GetCurrentThreadId () returned 0x2c8 [0096.427] IUnknown:Release (This=0x6b8548) returned 0x2 [0096.427] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.428] CoGetContextToken (in: pToken=0x2fe404 | out: pToken=0x2fe404) returned 0x0 [0096.428] CoGetContextToken (in: pToken=0x2fe028 | out: pToken=0x2fe028) returned 0x0 [0096.428] IUnknown:AddRef (This=0x6b8548) returned 0x3 [0096.428] ITypeInfo:LocalInvoke (This=0x6b8548) returned 0x0 [0096.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.428] GetCurrentThreadId () returned 0x2c8 [0096.428] IUnknown:AddRef (This=0x71299bc) returned 0x3 [0096.428] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.428] GetCurrentThreadId () returned 0x2c8 [0096.429] IEnumWbemClassObject:Clone (in: This=0x71299bc, ppEnum=0x2fe018 | out: ppEnum=0x2fe018*=0x7129a84) returned 0x0 [0096.429] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711d980 [0096.429] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711d9e0 [0096.429] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711da40 [0096.429] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71260a0 [0096.429] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7129ac0 [0096.429] IUnknown:QueryInterface (in: This=0x7129a84, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf30 | out: ppvObject=0x2fdf30*=0x7129a88) returned 0x0 [0096.429] IClientSecurity:QueryBlanket (in: This=0x7129a88, pProxy=0x7129a84, pAuthnSvc=0x2fdf20, pAuthzSvc=0x2fdf24, pServerPrincName=0x0, pAuthnLevel=0x2fdf4c, pImpLevel=0x2fdf48, pAuthInfo=0x0, pCapabilites=0x2fdf38 | out: pAuthnSvc=0x2fdf20*=0xa, pAuthzSvc=0x2fdf24*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf4c*=0x6, pImpLevel=0x2fdf48*=0x2, pAuthInfo=0x0, pCapabilites=0x2fdf38*=0x1) returned 0x0 [0096.429] IUnknown:Release (This=0x7129a88) returned 0x1 [0096.429] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.430] GetCurrentThreadId () returned 0x2c8 [0096.430] IUnknown:QueryInterface (in: This=0x71299bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf14 | out: ppvObject=0x2fdf14*=0x71299c0) returned 0x0 [0096.430] IClientSecurity:QueryBlanket (in: This=0x71299c0, pProxy=0x71299bc, pAuthnSvc=0x2fdf04, pAuthzSvc=0x2fdf08, pServerPrincName=0x0, pAuthnLevel=0x2fdf34, pImpLevel=0x2fdf38, pAuthInfo=0x0, pCapabilites=0x2fdf1c | out: pAuthnSvc=0x2fdf04*=0xa, pAuthzSvc=0x2fdf08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf34*=0x6, pImpLevel=0x2fdf38*=0x3, pAuthInfo=0x0, pCapabilites=0x2fdf1c*=0x20) returned 0x0 [0096.430] IUnknown:Release (This=0x71299c0) returned 0x3 [0096.430] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.430] GetCurrentThreadId () returned 0x2c8 [0096.430] IUnknown:QueryInterface (in: This=0x71299bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf14 | out: ppvObject=0x2fdf14*=0x71299c0) returned 0x0 [0096.430] IClientSecurity:QueryBlanket (in: This=0x71299c0, pProxy=0x71299bc, pAuthnSvc=0x2fdf04, pAuthzSvc=0x2fdf08, pServerPrincName=0x0, pAuthnLevel=0x2fdf38, pImpLevel=0x2fdf34, pAuthInfo=0x0, pCapabilites=0x2fdf1c | out: pAuthnSvc=0x2fdf04*=0xa, pAuthzSvc=0x2fdf08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf38*=0x6, pImpLevel=0x2fdf34*=0x3, pAuthInfo=0x0, pCapabilites=0x2fdf1c*=0x20) returned 0x0 [0096.430] IUnknown:Release (This=0x71299c0) returned 0x3 [0096.430] IUnknown:QueryInterface (in: This=0x7129a84, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf60 | out: ppvObject=0x2fdf60*=0x7129a88) returned 0x0 [0096.430] IClientSecurity:CopyProxy (in: This=0x7129a88, pProxy=0x7129a84, ppCopy=0x2fdf64 | out: ppCopy=0x2fdf64*=0x7129c04) returned 0x0 [0096.430] IUnknown:QueryInterface (in: This=0x7129c04, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde7c | out: ppvObject=0x2fde7c*=0x7129c08) returned 0x0 [0096.430] IClientSecurity:QueryBlanket (in: This=0x7129c08, pProxy=0x7129c04, pAuthnSvc=0x2fdea0, pAuthzSvc=0x2fde90, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fdea0*=0xa, pAuthzSvc=0x2fde90*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0096.430] IUnknown:Release (This=0x7129c08) returned 0x3 [0096.430] IUnknown:QueryInterface (in: This=0x7129c04, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde54 | out: ppvObject=0x2fde54*=0x6c31c4) returned 0x0 [0096.430] IUnknown:QueryInterface (in: This=0x7129c04, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde58 | out: ppvObject=0x2fde58*=0x7129c08) returned 0x0 [0096.430] IClientSecurity:SetBlanket (This=0x7129c08, pProxy=0x7129c04, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.431] IUnknown:Release (This=0x7129c08) returned 0x4 [0096.431] WbemLocator:IUnknown:Release (This=0x6c31c4) returned 0x3 [0096.431] IUnknown:Release (This=0x7129a88) returned 0x2 [0096.431] IUnknown:AddRef (This=0x7129c04) returned 0x3 [0096.431] IUnknown:Release (This=0x7129a84) returned 0x2 [0096.431] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fdfd0 | out: pperrinfo=0x2fdfd0*=0x0) returned 0x1 [0096.432] IUnknown:Release (This=0x71299bc) returned 0x2 [0096.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.432] GetCurrentThreadId () returned 0x2c8 [0096.432] IUnknown:AddRef (This=0x7129c04) returned 0x3 [0096.432] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.432] GetCurrentThreadId () returned 0x2c8 [0096.432] IEnumWbemClassObject:Reset (This=0x7129c04) returned 0x0 [0096.432] IUnknown:Release (This=0x7129c04) returned 0x2 [0096.432] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126840 [0096.432] IUnknown:Release (This=0x6b8548) returned 0x2 [0096.433] CoGetContextToken (in: pToken=0x2fda90 | out: pToken=0x2fda90) returned 0x0 [0096.433] CoGetContextToken (in: pToken=0x2fda54 | out: pToken=0x2fda54) returned 0x0 [0096.433] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fda88 | out: ppvObject=0x2fda88*=0x6484cc) returned 0x0 [0096.433] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdab8 | out: pAptType=0x2fdab8*=3) returned 0x0 [0096.433] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.433] CoGetContextToken (in: pToken=0x2fda88 | out: pToken=0x2fda88) returned 0x0 [0096.433] IUnknown:AddRef (This=0x7129c04) returned 0x3 [0096.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.433] GetCurrentThreadId () returned 0x2c8 [0096.434] IEnumWbemClassObject:Next (in: This=0x7129c04, lTimeout=-1, uCount=0x1, apObjects=0x2fe67c, puReturned=0x2fe674 | out: apObjects=0x2fe67c*=0x0, puReturned=0x2fe674*=0x0) returned 0x1 [0096.434] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fe630 | out: pperrinfo=0x2fe630*=0x0) returned 0x1 [0096.435] IUnknown:Release (This=0x7129c04) returned 0x2 [0096.435] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fe674 | out: pperrinfo=0x2fe674*=0x0) returned 0x1 [0096.435] IUnknown:AddRef (This=0x65ca58) returned 0x3 [0096.435] CoGetContextToken (in: pToken=0x2fdd64 | out: pToken=0x2fdd64) returned 0x0 [0096.435] CoGetContextToken (in: pToken=0x2fdd28 | out: pToken=0x2fdd28) returned 0x0 [0096.435] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd5c | out: ppvObject=0x2fdd5c*=0x6484cc) returned 0x0 [0096.435] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd8c | out: pAptType=0x2fdd8c*=3) returned 0x0 [0096.435] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.435] IUnknown:QueryInterface (in: This=0x65ca58, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd4c | out: ppvObject=0x2fdd4c*=0x0) returned 0x80004002 [0096.435] CoGetContextToken (in: pToken=0x2fdd5c | out: pToken=0x2fdd5c) returned 0x0 [0096.435] IUnknown:AddRef (This=0x65ca58) returned 0x4 [0096.435] IUnknown:QueryInterface (in: This=0x65ca58, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fddd0 | out: ppvObject=0x2fddd0*=0x0) returned 0x80004002 [0096.435] IUnknown:Release (This=0x65ca58) returned 0x3 [0096.436] MkParseDisplayName (pbc=0x65ca58, szUserName="winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\SecurityCenter", pchEaten=0x2fe700, ppmk=0x2fe644) [0096.436] DllGetClassObject (in: rclsid=0x6983e8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x772ff084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x2fe5b4 | out: ppv=0x2fe5b4*=0x0) returned 0x80004002 [0096.436] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126858 [0096.436] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.436] DllGetClassObject (in: rclsid=0x6983e8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x772fee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x2fe438 | out: ppv=0x2fe438*=0x7126858) returned 0x0 [0096.436] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126858 [0096.436] WinMGMTS:IClassFactory:CreateInstance (This=0x7126858, pUnkOuter=0x0, riid=0x772ff084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe3e4) [0096.440] WbemLocator:IClientSecurity:CopyProxy (in: This=0x6c3474, pProxy=0x7129e9c, ppCopy=0x2fe390 | out: ppCopy=0x2fe390*=0x711e9ac) returned 0x0 [0096.440] WbemLocator:IUnknown:QueryInterface (in: This=0x711e9ac, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe2a8 | out: ppvObject=0x2fe2a8*=0x6c3474) returned 0x0 [0096.440] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c3474, pProxy=0x711e9ac, pAuthnSvc=0x2fe2cc, pAuthzSvc=0x2fe2bc, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fe2cc*=0xa, pAuthzSvc=0x2fe2bc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0096.440] WbemLocator:IUnknown:Release (This=0x6c3474) returned 0x3 [0096.440] WbemLocator:IUnknown:QueryInterface (in: This=0x711e9ac, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe280 | out: ppvObject=0x2fe280*=0x6c3494) returned 0x0 [0096.440] WbemLocator:IUnknown:QueryInterface (in: This=0x711e9ac, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe284 | out: ppvObject=0x2fe284*=0x6c3474) returned 0x0 [0096.440] WbemLocator:IClientSecurity:SetBlanket (This=0x6c3474, pProxy=0x711e9ac, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.440] WbemLocator:IUnknown:Release (This=0x6c3474) returned 0x4 [0096.440] WbemLocator:IUnknown:Release (This=0x6c3494) returned 0x3 [0096.441] IUnknown:QueryInterface (in: This=0x6c5828, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdef4 | out: ppvObject=0x2fdef4*=0x6c5828) returned 0x0 [0096.441] IUnknown:QueryInterface (in: This=0x6c5828, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fdeb0 | out: ppvObject=0x2fdeb0*=0x0) returned 0x80004002 [0096.441] IUnknown:QueryInterface (in: This=0x6c5828, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fdda4 | out: ppvObject=0x2fdda4*=0x0) returned 0x80004002 [0096.441] IUnknown:AddRef (This=0x6c5828) returned 0x3 [0096.441] CoGetContextToken (in: pToken=0x2fdd3c | out: pToken=0x2fdd3c) returned 0x0 [0096.441] CoGetContextToken (in: pToken=0x2fdd00 | out: pToken=0x2fdd00) returned 0x0 [0096.441] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd34 | out: ppvObject=0x2fdd34*=0x6484cc) returned 0x0 [0096.441] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd64 | out: pAptType=0x2fdd64*=3) returned 0x0 [0096.441] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.441] IUnknown:QueryInterface (in: This=0x6c5828, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd24 | out: ppvObject=0x2fdd24*=0x6c583c) returned 0x0 [0096.441] IMarshal:GetUnmarshalClass (in: This=0x6c583c, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fdd2c | out: pCid=0x2fdd2c*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0096.441] IUnknown:Release (This=0x6c583c) returned 0x3 [0096.442] CoGetContextToken (in: pToken=0x2fdd34 | out: pToken=0x2fdd34) returned 0x0 [0096.442] IUnknown:AddRef (This=0x6c5828) returned 0x4 [0096.442] IUnknown:QueryInterface (in: This=0x6c5828, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdda8 | out: ppvObject=0x2fdda8*=0x0) returned 0x80004002 [0096.442] IUnknown:Release (This=0x6c5828) returned 0x3 [0096.442] IUnknown:AddRef (This=0x6c5828) returned 0x3 [0096.442] IUnknown:QueryInterface (in: This=0x6c5828, riid=0x2fe1e4*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe1e0 | out: ppvObject=0x2fe1e0*=0x6c5828) returned 0x0 [0096.442] IUnknown:Release (This=0x6c5828) returned 0x3 [0096.442] IUnknown:Release (This=0x6c5828) returned 0x2 [0096.442] IUnknown:Release (This=0x6c5828) returned 0x1 [0096.442] IUnknown:Release (This=0x65ca58) returned 0x2 [0096.442] CoGetContextToken (in: pToken=0x2fe234 | out: pToken=0x2fe234) returned 0x0 [0096.442] CoGetContextToken (in: pToken=0x2fe1f4 | out: pToken=0x2fe1f4) returned 0x0 [0096.442] IUnknown:AddRef (This=0x6c5828) returned 0x2 [0096.442] IUnknown:QueryInterface (in: This=0x6c5828, riid=0x2fe270*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe26c | out: ppvObject=0x2fe26c*=0x6c5828) returned 0x0 [0096.443] IUnknown:Release (This=0x6c5828) returned 0x2 [0096.443] IUnknown:AddRef (This=0x6c5828) returned 0x3 [0096.443] BindMoniker (in: pmk=0x6c5828, grfOpt=0x0, iidResult=0x1bf6614*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x2fe644 | out: ppvResult=0x2fe644*=0x7129eb0) returned 0x0 [0096.443] IUnknown:QueryInterface (in: This=0x7129eb0, riid=0x1bf6614*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe644 | out: ppvObject=0x2fe644*=0x7129eb0) returned 0x0 [0096.443] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x2fdd6c*=0x0 | out: pptlib=0x2fdd6c*=0x691658) returned 0x0 [0096.444] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x7129ef4, ppTInfo=0x7129edc | out: ppTInfo=0x7129edc*=0x6b846c) returned 0x0 [0096.444] IUnknown:Release (This=0x691658) returned 0x6 [0096.444] IUnknown:AddRef (This=0x6b846c) returned 0x4 [0096.444] ITypeInfo:RemoteGetTypeAttr (in: This=0x6b846c, ppTypeAttr=0x2fddb0, pDummy=0xe54421b5 | out: ppTypeAttr=0x2fddb0, pDummy=0xe54421b5) returned 0x0 [0096.444] ITypeInfo:LocalReleaseTypeAttr (This=0x6b846c) returned 0x6afa30 [0096.445] IUnknown:Release (This=0x6b846c) returned 0x3 [0096.445] CoGetContextToken (in: pToken=0x2fdd3c | out: pToken=0x2fdd3c) returned 0x0 [0096.445] CoGetContextToken (in: pToken=0x2fdd00 | out: pToken=0x2fdd00) returned 0x0 [0096.445] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd34 | out: ppvObject=0x2fdd34*=0x6484cc) returned 0x0 [0096.445] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd64 | out: pAptType=0x2fdd64*=3) returned 0x0 [0096.445] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.445] CoGetContextToken (in: pToken=0x2fdd34 | out: pToken=0x2fdd34) returned 0x0 [0096.446] IUnknown:AddRef (This=0x6b8498) returned 0x3 [0096.446] DispGetIDsOfNames (in: ptinfo=0x6b8498, rgszNames=0x2fe2d0*="ExecQuery", cNames=0x1, rgdispid=0x2fe2c0 | out: rgdispid=0x2fe2c0*=9) returned 0x0 [0096.446] IUnknown:Release (This=0x6b8498) returned 0x2 [0096.446] IUnknown:AddRef (This=0x6b8498) returned 0x3 [0096.446] ITypeInfo:LocalInvoke (This=0x6b8498) returned 0x0 [0096.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.446] GetCurrentThreadId () returned 0x2c8 [0096.446] IWbemServices:ExecQuery (in: This=0x71298bc, strQueryLanguage="WQL", strQuery="Select * from AntiVirusProduct", lFlags=272, pCtx=0x0, ppEnum=0x2fdf18 | out: ppEnum=0x2fdf18*=0x7129ccc) returned 0x0 [0096.448] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711daa0 [0096.448] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dbc0 [0096.448] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dc20 [0096.448] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71260c0 [0096.448] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7129d08 [0096.449] IUnknown:QueryInterface (in: This=0x7129ccc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde30 | out: ppvObject=0x2fde30*=0x7129cd0) returned 0x0 [0096.449] IClientSecurity:QueryBlanket (in: This=0x7129cd0, pProxy=0x7129ccc, pAuthnSvc=0x2fde20, pAuthzSvc=0x2fde24, pServerPrincName=0x0, pAuthnLevel=0x2fde4c, pImpLevel=0x2fde48, pAuthInfo=0x0, pCapabilites=0x2fde38 | out: pAuthnSvc=0x2fde20*=0xa, pAuthzSvc=0x2fde24*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fde4c*=0x6, pImpLevel=0x2fde48*=0x2, pAuthInfo=0x0, pCapabilites=0x2fde38*=0x1) returned 0x0 [0096.449] IUnknown:Release (This=0x7129cd0) returned 0x1 [0096.449] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.449] GetCurrentThreadId () returned 0x2c8 [0096.449] IUnknown:QueryInterface (in: This=0x7129ccc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde60 | out: ppvObject=0x2fde60*=0x7129cd0) returned 0x0 [0096.449] IClientSecurity:CopyProxy (in: This=0x7129cd0, pProxy=0x7129ccc, ppCopy=0x2fde64 | out: ppCopy=0x2fde64*=0x711ea4c) returned 0x0 [0096.449] IUnknown:QueryInterface (in: This=0x711ea4c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd7c | out: ppvObject=0x2fdd7c*=0x711ea50) returned 0x0 [0096.449] IClientSecurity:QueryBlanket (in: This=0x711ea50, pProxy=0x711ea4c, pAuthnSvc=0x2fdda0, pAuthzSvc=0x2fdd90, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fdda0*=0xa, pAuthzSvc=0x2fdd90*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0096.449] IUnknown:Release (This=0x711ea50) returned 0x3 [0096.451] IUnknown:QueryInterface (in: This=0x711ea4c, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd54 | out: ppvObject=0x2fdd54*=0x6c33a4) returned 0x0 [0096.451] IUnknown:QueryInterface (in: This=0x711ea4c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd58 | out: ppvObject=0x2fdd58*=0x711ea50) returned 0x0 [0096.451] IClientSecurity:SetBlanket (This=0x711ea50, pProxy=0x711ea4c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.452] IUnknown:Release (This=0x711ea50) returned 0x4 [0096.452] WbemLocator:IUnknown:Release (This=0x6c33a4) returned 0x3 [0096.452] IUnknown:Release (This=0x7129cd0) returned 0x2 [0096.452] IUnknown:AddRef (This=0x711ea4c) returned 0x3 [0096.452] IUnknown:Release (This=0x7129ccc) returned 0x2 [0096.452] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fded0 | out: pperrinfo=0x2fded0*=0x0) returned 0x1 [0096.453] IUnknown:Release (This=0x6b8498) returned 0x2 [0096.453] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x2fdb70*=0x0 | out: pptlib=0x2fdb70*=0x691658) returned 0x0 [0096.454] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x711dad8, ppTInfo=0x711dac0 | out: ppTInfo=0x711dac0*=0x6b85a0) returned 0x0 [0096.454] IUnknown:Release (This=0x691658) returned 0x6 [0096.454] IUnknown:AddRef (This=0x6b85a0) returned 0x4 [0096.454] ITypeInfo:RemoteGetTypeAttr (in: This=0x6b85a0, ppTypeAttr=0x2fdbb4, pDummy=0xe54427b1 | out: ppTypeAttr=0x2fdbb4, pDummy=0xe54427b1) returned 0x0 [0096.454] ITypeInfo:LocalReleaseTypeAttr (This=0x6b85a0) returned 0x6afad8 [0096.454] IUnknown:Release (This=0x6b85a0) returned 0x3 [0096.454] CoGetContextToken (in: pToken=0x2fdb40 | out: pToken=0x2fdb40) returned 0x0 [0096.455] CoGetContextToken (in: pToken=0x2fdb04 | out: pToken=0x2fdb04) returned 0x0 [0096.455] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdb38 | out: ppvObject=0x2fdb38*=0x6484cc) returned 0x0 [0096.455] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdb68 | out: pAptType=0x2fdb68*=3) returned 0x0 [0096.455] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.455] CoGetContextToken (in: pToken=0x2fdb38 | out: pToken=0x2fdb38) returned 0x0 [0096.455] CoGetContextToken (in: pToken=0x2fe4fc | out: pToken=0x2fe4fc) returned 0x0 [0096.455] CoGetContextToken (in: pToken=0x2fe4bc | out: pToken=0x2fe4bc) returned 0x0 [0096.456] CoGetContextToken (in: pToken=0x2fe544 | out: pToken=0x2fe544) returned 0x0 [0096.456] IUnknown:AddRef (This=0x6b8548) returned 0x3 [0096.456] ITypeInfo:LocalInvoke (This=0x6b8548) returned 0x0 [0096.456] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.456] GetCurrentThreadId () returned 0x2c8 [0096.456] IUnknown:AddRef (This=0x71299bc) returned 0x3 [0096.456] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.456] GetCurrentThreadId () returned 0x2c8 [0096.456] IEnumWbemClassObject:Clone (in: This=0x71299bc, ppEnum=0x2fe430 | out: ppEnum=0x2fe430*=0x711eb14) returned 0x0 [0096.457] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dc80 [0096.457] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dce0 [0096.457] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dd40 [0096.457] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126100 [0096.457] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711eb50 [0096.457] IUnknown:QueryInterface (in: This=0x711eb14, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe348 | out: ppvObject=0x2fe348*=0x711eb18) returned 0x0 [0096.457] IClientSecurity:QueryBlanket (in: This=0x711eb18, pProxy=0x711eb14, pAuthnSvc=0x2fe338, pAuthzSvc=0x2fe33c, pServerPrincName=0x0, pAuthnLevel=0x2fe364, pImpLevel=0x2fe360, pAuthInfo=0x0, pCapabilites=0x2fe350 | out: pAuthnSvc=0x2fe338*=0xa, pAuthzSvc=0x2fe33c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fe364*=0x6, pImpLevel=0x2fe360*=0x2, pAuthInfo=0x0, pCapabilites=0x2fe350*=0x1) returned 0x0 [0096.457] IUnknown:Release (This=0x711eb18) returned 0x1 [0096.457] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.457] GetCurrentThreadId () returned 0x2c8 [0096.457] IUnknown:QueryInterface (in: This=0x71299bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe32c | out: ppvObject=0x2fe32c*=0x71299c0) returned 0x0 [0096.457] IClientSecurity:QueryBlanket (in: This=0x71299c0, pProxy=0x71299bc, pAuthnSvc=0x2fe31c, pAuthzSvc=0x2fe320, pServerPrincName=0x0, pAuthnLevel=0x2fe34c, pImpLevel=0x2fe350, pAuthInfo=0x0, pCapabilites=0x2fe334 | out: pAuthnSvc=0x2fe31c*=0xa, pAuthzSvc=0x2fe320*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fe34c*=0x6, pImpLevel=0x2fe350*=0x3, pAuthInfo=0x0, pCapabilites=0x2fe334*=0x20) returned 0x0 [0096.457] IUnknown:Release (This=0x71299c0) returned 0x3 [0096.457] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.457] GetCurrentThreadId () returned 0x2c8 [0096.458] IUnknown:QueryInterface (in: This=0x71299bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe32c | out: ppvObject=0x2fe32c*=0x71299c0) returned 0x0 [0096.458] IClientSecurity:QueryBlanket (in: This=0x71299c0, pProxy=0x71299bc, pAuthnSvc=0x2fe31c, pAuthzSvc=0x2fe320, pServerPrincName=0x0, pAuthnLevel=0x2fe350, pImpLevel=0x2fe34c, pAuthInfo=0x0, pCapabilites=0x2fe334 | out: pAuthnSvc=0x2fe31c*=0xa, pAuthzSvc=0x2fe320*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fe350*=0x6, pImpLevel=0x2fe34c*=0x3, pAuthInfo=0x0, pCapabilites=0x2fe334*=0x20) returned 0x0 [0096.458] IUnknown:Release (This=0x71299c0) returned 0x3 [0096.458] IUnknown:QueryInterface (in: This=0x711eb14, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe378 | out: ppvObject=0x2fe378*=0x711eb18) returned 0x0 [0096.458] IClientSecurity:CopyProxy (in: This=0x711eb18, pProxy=0x711eb14, ppCopy=0x2fe37c | out: ppCopy=0x2fe37c*=0x711ec94) returned 0x0 [0096.458] IUnknown:QueryInterface (in: This=0x711ec94, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe294 | out: ppvObject=0x2fe294*=0x711ec98) returned 0x0 [0096.458] IClientSecurity:QueryBlanket (in: This=0x711ec98, pProxy=0x711ec94, pAuthnSvc=0x2fe2b8, pAuthzSvc=0x2fe2a8, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fe2b8*=0xa, pAuthzSvc=0x2fe2a8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0096.458] IUnknown:Release (This=0x711ec98) returned 0x3 [0096.458] IUnknown:QueryInterface (in: This=0x711ec94, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe26c | out: ppvObject=0x2fe26c*=0x6c3674) returned 0x0 [0096.458] IUnknown:QueryInterface (in: This=0x711ec94, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe270 | out: ppvObject=0x2fe270*=0x711ec98) returned 0x0 [0096.458] IClientSecurity:SetBlanket (This=0x711ec98, pProxy=0x711ec94, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.459] IUnknown:Release (This=0x711ec98) returned 0x4 [0096.459] WbemLocator:IUnknown:Release (This=0x6c3674) returned 0x3 [0096.459] IUnknown:Release (This=0x711eb18) returned 0x2 [0096.459] IUnknown:AddRef (This=0x711ec94) returned 0x3 [0096.459] IUnknown:Release (This=0x711eb14) returned 0x2 [0096.459] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fe3e8 | out: pperrinfo=0x2fe3e8*=0x0) returned 0x1 [0096.459] IUnknown:Release (This=0x71299bc) returned 0x2 [0096.459] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.459] GetCurrentThreadId () returned 0x2c8 [0096.459] IUnknown:AddRef (This=0x711ec94) returned 0x3 [0096.459] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.460] GetCurrentThreadId () returned 0x2c8 [0096.460] IEnumWbemClassObject:Reset (This=0x711ec94) returned 0x0 [0096.460] IUnknown:Release (This=0x711ec94) returned 0x2 [0096.460] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126888 [0096.460] IUnknown:Release (This=0x6b8548) returned 0x2 [0096.460] IUnknown:Release (This=0x711ec94) returned 0x1 [0096.460] IUnknown:Release (This=0x711ec94) returned 0x0 [0096.461] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.461] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.461] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.461] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.461] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.461] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.461] CoGetContextToken (in: pToken=0x2fe404 | out: pToken=0x2fe404) returned 0x0 [0096.462] CoGetContextToken (in: pToken=0x2fe028 | out: pToken=0x2fe028) returned 0x0 [0096.462] IUnknown:AddRef (This=0x6b8548) returned 0x3 [0096.462] ITypeInfo:LocalInvoke (This=0x6b8548) returned 0x0 [0096.462] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.462] GetCurrentThreadId () returned 0x2c8 [0096.462] IUnknown:AddRef (This=0x71299bc) returned 0x3 [0096.462] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.462] GetCurrentThreadId () returned 0x2c8 [0096.462] IEnumWbemClassObject:Clone (in: This=0x71299bc, ppEnum=0x2fe018 | out: ppEnum=0x2fe018*=0x711eb14) returned 0x0 [0096.463] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dc80 [0096.463] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dce0 [0096.463] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dd40 [0096.463] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126100 [0096.463] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711eb50 [0096.463] IUnknown:QueryInterface (in: This=0x711eb14, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf30 | out: ppvObject=0x2fdf30*=0x711eb18) returned 0x0 [0096.463] IClientSecurity:QueryBlanket (in: This=0x711eb18, pProxy=0x711eb14, pAuthnSvc=0x2fdf20, pAuthzSvc=0x2fdf24, pServerPrincName=0x0, pAuthnLevel=0x2fdf4c, pImpLevel=0x2fdf48, pAuthInfo=0x0, pCapabilites=0x2fdf38 | out: pAuthnSvc=0x2fdf20*=0xa, pAuthzSvc=0x2fdf24*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf4c*=0x6, pImpLevel=0x2fdf48*=0x2, pAuthInfo=0x0, pCapabilites=0x2fdf38*=0x1) returned 0x0 [0096.463] IUnknown:Release (This=0x711eb18) returned 0x1 [0096.463] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.463] GetCurrentThreadId () returned 0x2c8 [0096.463] IUnknown:QueryInterface (in: This=0x71299bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf14 | out: ppvObject=0x2fdf14*=0x71299c0) returned 0x0 [0096.463] IClientSecurity:QueryBlanket (in: This=0x71299c0, pProxy=0x71299bc, pAuthnSvc=0x2fdf04, pAuthzSvc=0x2fdf08, pServerPrincName=0x0, pAuthnLevel=0x2fdf34, pImpLevel=0x2fdf38, pAuthInfo=0x0, pCapabilites=0x2fdf1c | out: pAuthnSvc=0x2fdf04*=0xa, pAuthzSvc=0x2fdf08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf34*=0x6, pImpLevel=0x2fdf38*=0x3, pAuthInfo=0x0, pCapabilites=0x2fdf1c*=0x20) returned 0x0 [0096.463] IUnknown:Release (This=0x71299c0) returned 0x3 [0096.463] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.463] GetCurrentThreadId () returned 0x2c8 [0096.463] IUnknown:QueryInterface (in: This=0x71299bc, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf14 | out: ppvObject=0x2fdf14*=0x71299c0) returned 0x0 [0096.464] IClientSecurity:QueryBlanket (in: This=0x71299c0, pProxy=0x71299bc, pAuthnSvc=0x2fdf04, pAuthzSvc=0x2fdf08, pServerPrincName=0x0, pAuthnLevel=0x2fdf38, pImpLevel=0x2fdf34, pAuthInfo=0x0, pCapabilites=0x2fdf1c | out: pAuthnSvc=0x2fdf04*=0xa, pAuthzSvc=0x2fdf08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf38*=0x6, pImpLevel=0x2fdf34*=0x3, pAuthInfo=0x0, pCapabilites=0x2fdf1c*=0x20) returned 0x0 [0096.464] IUnknown:Release (This=0x71299c0) returned 0x3 [0096.464] IUnknown:QueryInterface (in: This=0x711eb14, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf60 | out: ppvObject=0x2fdf60*=0x711eb18) returned 0x0 [0096.464] IClientSecurity:CopyProxy (in: This=0x711eb18, pProxy=0x711eb14, ppCopy=0x2fdf64 | out: ppCopy=0x2fdf64*=0x711ec94) returned 0x0 [0096.464] IUnknown:QueryInterface (in: This=0x711ec94, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde7c | out: ppvObject=0x2fde7c*=0x711ec98) returned 0x0 [0096.464] IClientSecurity:QueryBlanket (in: This=0x711ec98, pProxy=0x711ec94, pAuthnSvc=0x2fdea0, pAuthzSvc=0x2fde90, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fdea0*=0xa, pAuthzSvc=0x2fde90*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0096.464] IUnknown:Release (This=0x711ec98) returned 0x3 [0096.464] IUnknown:QueryInterface (in: This=0x711ec94, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde54 | out: ppvObject=0x2fde54*=0x6c3674) returned 0x0 [0096.464] IUnknown:QueryInterface (in: This=0x711ec94, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde58 | out: ppvObject=0x2fde58*=0x711ec98) returned 0x0 [0096.464] IClientSecurity:SetBlanket (This=0x711ec98, pProxy=0x711ec94, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.477] IUnknown:Release (This=0x711ec98) returned 0x4 [0096.477] WbemLocator:IUnknown:Release (This=0x6c3674) returned 0x3 [0096.477] IUnknown:Release (This=0x711eb18) returned 0x2 [0096.477] IUnknown:AddRef (This=0x711ec94) returned 0x3 [0096.477] IUnknown:Release (This=0x711eb14) returned 0x2 [0096.477] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fdfd0 | out: pperrinfo=0x2fdfd0*=0x0) returned 0x1 [0096.477] IUnknown:Release (This=0x71299bc) returned 0x2 [0096.477] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.477] GetCurrentThreadId () returned 0x2c8 [0096.477] IUnknown:AddRef (This=0x711ec94) returned 0x3 [0096.478] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.478] GetCurrentThreadId () returned 0x2c8 [0096.478] IEnumWbemClassObject:Reset (This=0x711ec94) returned 0x0 [0096.478] IUnknown:Release (This=0x711ec94) returned 0x2 [0096.478] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126888 [0096.478] IUnknown:Release (This=0x6b8548) returned 0x2 [0096.479] CoGetContextToken (in: pToken=0x2fda90 | out: pToken=0x2fda90) returned 0x0 [0096.479] CoGetContextToken (in: pToken=0x2fda54 | out: pToken=0x2fda54) returned 0x0 [0096.479] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fda88 | out: ppvObject=0x2fda88*=0x6484cc) returned 0x0 [0096.479] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdab8 | out: pAptType=0x2fdab8*=3) returned 0x0 [0096.479] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.479] CoGetContextToken (in: pToken=0x2fda88 | out: pToken=0x2fda88) returned 0x0 [0096.479] IUnknown:AddRef (This=0x711ec94) returned 0x3 [0096.479] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.479] GetCurrentThreadId () returned 0x2c8 [0096.480] IEnumWbemClassObject:Next (in: This=0x711ec94, lTimeout=-1, uCount=0x1, apObjects=0x2fe67c, puReturned=0x2fe674 | out: apObjects=0x2fe67c*=0x0, puReturned=0x2fe674*=0x0) returned 0x1 [0096.480] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fe630 | out: pperrinfo=0x2fe630*=0x0) returned 0x1 [0096.480] IUnknown:Release (This=0x711ec94) returned 0x2 [0096.480] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fe674 | out: pperrinfo=0x2fe674*=0x0) returned 0x1 [0096.591] IUnknown:AddRef (This=0x65ca98) returned 0x3 [0096.591] CoGetContextToken (in: pToken=0x2fdd74 | out: pToken=0x2fdd74) returned 0x0 [0096.591] CoGetContextToken (in: pToken=0x2fdd38 | out: pToken=0x2fdd38) returned 0x0 [0096.591] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd6c | out: ppvObject=0x2fdd6c*=0x6484cc) returned 0x0 [0096.592] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd9c | out: pAptType=0x2fdd9c*=3) returned 0x0 [0096.592] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.592] IUnknown:QueryInterface (in: This=0x65ca98, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd5c | out: ppvObject=0x2fdd5c*=0x0) returned 0x80004002 [0096.592] CoGetContextToken (in: pToken=0x2fdd6c | out: pToken=0x2fdd6c) returned 0x0 [0096.592] IUnknown:AddRef (This=0x65ca98) returned 0x4 [0096.592] IUnknown:QueryInterface (in: This=0x65ca98, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdde0 | out: ppvObject=0x2fdde0*=0x0) returned 0x80004002 [0096.592] IUnknown:Release (This=0x65ca98) returned 0x3 [0096.596] IUnknown:QueryInterface (in: This=0x6d0b48, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf04 | out: ppvObject=0x2fdf04*=0x6d0b48) returned 0x0 [0096.596] IUnknown:QueryInterface (in: This=0x6d0b48, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fdec0 | out: ppvObject=0x2fdec0*=0x0) returned 0x80004002 [0096.596] IUnknown:QueryInterface (in: This=0x6d0b48, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fddb4 | out: ppvObject=0x2fddb4*=0x0) returned 0x80004002 [0096.596] IUnknown:AddRef (This=0x6d0b48) returned 0x3 [0096.596] CoGetContextToken (in: pToken=0x2fdd4c | out: pToken=0x2fdd4c) returned 0x0 [0096.596] CoGetContextToken (in: pToken=0x2fdd10 | out: pToken=0x2fdd10) returned 0x0 [0096.596] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd44 | out: ppvObject=0x2fdd44*=0x6484cc) returned 0x0 [0096.597] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd74 | out: pAptType=0x2fdd74*=3) returned 0x0 [0096.597] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.597] IUnknown:QueryInterface (in: This=0x6d0b48, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd34 | out: ppvObject=0x2fdd34*=0x6d0b5c) returned 0x0 [0096.597] IMarshal:GetUnmarshalClass (in: This=0x6d0b5c, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fdd3c | out: pCid=0x2fdd3c*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0096.597] IUnknown:Release (This=0x6d0b5c) returned 0x3 [0096.597] CoGetContextToken (in: pToken=0x2fdd44 | out: pToken=0x2fdd44) returned 0x0 [0096.597] IUnknown:AddRef (This=0x6d0b48) returned 0x4 [0096.597] IUnknown:QueryInterface (in: This=0x6d0b48, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fddb8 | out: ppvObject=0x2fddb8*=0x0) returned 0x80004002 [0096.597] IUnknown:Release (This=0x6d0b48) returned 0x3 [0096.597] IUnknown:AddRef (This=0x6d0b48) returned 0x3 [0096.597] IUnknown:QueryInterface (in: This=0x6d0b48, riid=0x2fe1f4*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe1f0 | out: ppvObject=0x2fe1f0*=0x6d0b48) returned 0x0 [0096.598] IUnknown:Release (This=0x6d0b48) returned 0x3 [0096.598] IUnknown:Release (This=0x6d0b48) returned 0x2 [0096.598] IUnknown:Release (This=0x6d0b48) returned 0x1 [0096.598] IUnknown:Release (This=0x65ca98) returned 0x2 [0096.598] CoGetContextToken (in: pToken=0x2fe244 | out: pToken=0x2fe244) returned 0x0 [0096.598] CoGetContextToken (in: pToken=0x2fe204 | out: pToken=0x2fe204) returned 0x0 [0096.598] IUnknown:AddRef (This=0x6d0b48) returned 0x2 [0096.598] IUnknown:QueryInterface (in: This=0x6d0b48, riid=0x2fe280*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe27c | out: ppvObject=0x2fe27c*=0x6d0b48) returned 0x0 [0096.598] IUnknown:Release (This=0x6d0b48) returned 0x2 [0096.598] IUnknown:AddRef (This=0x6d0b48) returned 0x3 [0096.598] BindMoniker (in: pmk=0x6d0b48, grfOpt=0x0, iidResult=0x1bf6614*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x2fe654 | out: ppvResult=0x2fe654*=0x711eed8) returned 0x0 [0096.598] IUnknown:QueryInterface (in: This=0x711eed8, riid=0x1bf6614*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe654 | out: ppvObject=0x2fe654*=0x711eed8) returned 0x0 [0096.599] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x2fdd7c*=0x0 | out: pptlib=0x2fdd7c*=0x691658) returned 0x0 [0096.600] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x711ef1c, ppTInfo=0x711ef04 | out: ppTInfo=0x711ef04*=0x6b846c) returned 0x0 [0096.600] IUnknown:Release (This=0x691658) returned 0x6 [0096.600] IUnknown:AddRef (This=0x6b846c) returned 0x5 [0096.600] ITypeInfo:RemoteGetTypeAttr (in: This=0x6b846c, ppTypeAttr=0x2fddc0, pDummy=0xe54421a5 | out: ppTypeAttr=0x2fddc0, pDummy=0xe54421a5) returned 0x0 [0096.600] ITypeInfo:LocalReleaseTypeAttr (This=0x6b846c) returned 0x6afad8 [0096.600] IUnknown:Release (This=0x6b846c) returned 0x4 [0096.600] CoGetContextToken (in: pToken=0x2fdd4c | out: pToken=0x2fdd4c) returned 0x0 [0096.600] CoGetContextToken (in: pToken=0x2fdd10 | out: pToken=0x2fdd10) returned 0x0 [0096.600] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd44 | out: ppvObject=0x2fdd44*=0x6484cc) returned 0x0 [0096.601] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdd74 | out: pAptType=0x2fdd74*=3) returned 0x0 [0096.601] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.601] CoGetContextToken (in: pToken=0x2fdd44 | out: pToken=0x2fdd44) returned 0x0 [0096.601] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x2fe284*=0x0 | out: pptlib=0x2fe284*=0x691658) returned 0x0 [0096.602] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x711ef0c, ppTInfo=0x711ef00 | out: ppTInfo=0x711ef00*=0x6b8498) returned 0x0 [0096.602] IUnknown:Release (This=0x691658) returned 0x6 [0096.602] IUnknown:AddRef (This=0x6b8498) returned 0x4 [0096.603] DispGetIDsOfNames (in: ptinfo=0x6b8498, rgszNames=0x2fe2e0*="ExecQuery", cNames=0x1, rgdispid=0x2fe2d0 | out: rgdispid=0x2fe2d0*=9) returned 0x0 [0096.603] IUnknown:Release (This=0x6b8498) returned 0x3 [0096.603] IUnknown:AddRef (This=0x6b8498) returned 0x4 [0096.603] ITypeInfo:LocalInvoke (This=0x6b8498) returned 0x0 [0096.603] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.603] GetCurrentThreadId () returned 0x2c8 [0096.603] IWbemServices:ExecQuery (in: This=0x711f044, strQueryLanguage="WQL", strQuery="SELECT * FROM FirewallProduct", lFlags=272, pCtx=0x0, ppEnum=0x2fdf28 | out: ppEnum=0x2fdf28*=0x711ed5c) returned 0x0 [0096.609] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dda0 [0096.609] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dec0 [0096.609] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711df20 [0096.609] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126120 [0096.609] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711ed98 [0096.609] IUnknown:QueryInterface (in: This=0x711ed5c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde40 | out: ppvObject=0x2fde40*=0x711ed60) returned 0x0 [0096.609] IClientSecurity:QueryBlanket (in: This=0x711ed60, pProxy=0x711ed5c, pAuthnSvc=0x2fde30, pAuthzSvc=0x2fde34, pServerPrincName=0x0, pAuthnLevel=0x2fde5c, pImpLevel=0x2fde58, pAuthInfo=0x0, pCapabilites=0x2fde48 | out: pAuthnSvc=0x2fde30*=0xa, pAuthzSvc=0x2fde34*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fde5c*=0x6, pImpLevel=0x2fde58*=0x2, pAuthInfo=0x0, pCapabilites=0x2fde48*=0x1) returned 0x0 [0096.609] IUnknown:Release (This=0x711ed60) returned 0x1 [0096.609] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.609] GetCurrentThreadId () returned 0x2c8 [0096.609] IUnknown:QueryInterface (in: This=0x711ed5c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde70 | out: ppvObject=0x2fde70*=0x711ed60) returned 0x0 [0096.609] IClientSecurity:CopyProxy (in: This=0x711ed60, pProxy=0x711ed5c, ppCopy=0x2fde74 | out: ppCopy=0x2fde74*=0x711f0e4) returned 0x0 [0096.609] IUnknown:QueryInterface (in: This=0x711f0e4, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd8c | out: ppvObject=0x2fdd8c*=0x711f0e8) returned 0x0 [0096.609] IClientSecurity:QueryBlanket (in: This=0x711f0e8, pProxy=0x711f0e4, pAuthnSvc=0x2fddb0, pAuthzSvc=0x2fdda0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fddb0*=0xa, pAuthzSvc=0x2fdda0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0096.609] IUnknown:Release (This=0x711f0e8) returned 0x3 [0096.610] IUnknown:QueryInterface (in: This=0x711f0e4, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd64 | out: ppvObject=0x2fdd64*=0x6c3854) returned 0x0 [0096.610] IUnknown:QueryInterface (in: This=0x711f0e4, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdd68 | out: ppvObject=0x2fdd68*=0x711f0e8) returned 0x0 [0096.610] IClientSecurity:SetBlanket (This=0x711f0e8, pProxy=0x711f0e4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.611] IUnknown:Release (This=0x711f0e8) returned 0x4 [0096.611] WbemLocator:IUnknown:Release (This=0x6c3854) returned 0x3 [0096.611] IUnknown:Release (This=0x711ed60) returned 0x2 [0096.611] IUnknown:AddRef (This=0x711f0e4) returned 0x3 [0096.611] IUnknown:Release (This=0x711ed5c) returned 0x2 [0096.611] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fdee0 | out: pperrinfo=0x2fdee0*=0x0) returned 0x1 [0096.611] IUnknown:Release (This=0x6b8498) returned 0x3 [0096.612] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x2fdb80*=0x0 | out: pptlib=0x2fdb80*=0x691658) returned 0x0 [0096.613] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x711ddd8, ppTInfo=0x711ddc0 | out: ppTInfo=0x711ddc0*=0x6b85a0) returned 0x0 [0096.613] IUnknown:Release (This=0x691658) returned 0x6 [0096.613] IUnknown:AddRef (This=0x6b85a0) returned 0x5 [0096.613] ITypeInfo:RemoteGetTypeAttr (in: This=0x6b85a0, ppTypeAttr=0x2fdbc4, pDummy=0xe54427a1 | out: ppTypeAttr=0x2fdbc4, pDummy=0xe54427a1) returned 0x0 [0096.613] ITypeInfo:LocalReleaseTypeAttr (This=0x6b85a0) returned 0x6afad8 [0096.613] IUnknown:Release (This=0x6b85a0) returned 0x4 [0096.614] CoGetContextToken (in: pToken=0x2fdb50 | out: pToken=0x2fdb50) returned 0x0 [0096.614] CoGetContextToken (in: pToken=0x2fdb14 | out: pToken=0x2fdb14) returned 0x0 [0096.614] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdb48 | out: ppvObject=0x2fdb48*=0x6484cc) returned 0x0 [0096.614] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdb78 | out: pAptType=0x2fdb78*=3) returned 0x0 [0096.614] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.614] CoGetContextToken (in: pToken=0x2fdb48 | out: pToken=0x2fdb48) returned 0x0 [0096.614] CoGetContextToken (in: pToken=0x2fe50c | out: pToken=0x2fe50c) returned 0x0 [0096.614] CoGetContextToken (in: pToken=0x2fe4cc | out: pToken=0x2fe4cc) returned 0x0 [0096.615] CoGetContextToken (in: pToken=0x2fe554 | out: pToken=0x2fe554) returned 0x0 [0096.615] LoadRegTypeLib (in: rguid=0x5fb4364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x2fe554*=0x0 | out: pptlib=0x2fe554*=0x691658) returned 0x0 [0096.616] ITypeLib:GetTypeInfoOfGuid (in: This=0x691658, GUID=0x711ddc8, ppTInfo=0x711ddbc | out: ppTInfo=0x711ddbc*=0x6b8548) returned 0x0 [0096.616] IUnknown:Release (This=0x691658) returned 0x6 [0096.616] IUnknown:AddRef (This=0x6b8548) returned 0x4 [0096.616] ITypeInfo:LocalInvoke (This=0x6b8548) returned 0x0 [0096.616] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.616] GetCurrentThreadId () returned 0x2c8 [0096.616] IUnknown:Release (This=0x6b8548) returned 0x3 [0096.616] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0096.617] CoGetContextToken (in: pToken=0x2fe414 | out: pToken=0x2fe414) returned 0x0 [0096.617] CoGetContextToken (in: pToken=0x2fe038 | out: pToken=0x2fe038) returned 0x0 [0096.617] IUnknown:AddRef (This=0x6b8548) returned 0x4 [0096.617] ITypeInfo:LocalInvoke (This=0x6b8548) returned 0x0 [0096.617] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.617] GetCurrentThreadId () returned 0x2c8 [0096.618] IUnknown:AddRef (This=0x711f0e4) returned 0x3 [0096.618] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.618] GetCurrentThreadId () returned 0x2c8 [0096.618] IEnumWbemClassObject:Clone (in: This=0x711f0e4, ppEnum=0x2fe028 | out: ppEnum=0x2fe028*=0x712a07c) returned 0x0 [0096.619] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711df80 [0096.619] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x711dfe0 [0096.619] IUnknown:QueryInterface (in: This=0x712a07c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf40 | out: ppvObject=0x2fdf40*=0x712a080) returned 0x0 [0096.619] IClientSecurity:QueryBlanket (in: This=0x712a080, pProxy=0x712a07c, pAuthnSvc=0x2fdf30, pAuthzSvc=0x2fdf34, pServerPrincName=0x0, pAuthnLevel=0x2fdf5c, pImpLevel=0x2fdf58, pAuthInfo=0x0, pCapabilites=0x2fdf48 | out: pAuthnSvc=0x2fdf30*=0xa, pAuthzSvc=0x2fdf34*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf5c*=0x6, pImpLevel=0x2fdf58*=0x2, pAuthInfo=0x0, pCapabilites=0x2fdf48*=0x1) returned 0x0 [0096.619] IUnknown:Release (This=0x712a080) returned 0x1 [0096.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.619] GetCurrentThreadId () returned 0x2c8 [0096.619] IUnknown:QueryInterface (in: This=0x711f0e4, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf24 | out: ppvObject=0x2fdf24*=0x711f0e8) returned 0x0 [0096.619] IClientSecurity:QueryBlanket (in: This=0x711f0e8, pProxy=0x711f0e4, pAuthnSvc=0x2fdf14, pAuthzSvc=0x2fdf18, pServerPrincName=0x0, pAuthnLevel=0x2fdf44, pImpLevel=0x2fdf48, pAuthInfo=0x0, pCapabilites=0x2fdf2c | out: pAuthnSvc=0x2fdf14*=0xa, pAuthzSvc=0x2fdf18*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf44*=0x6, pImpLevel=0x2fdf48*=0x3, pAuthInfo=0x0, pCapabilites=0x2fdf2c*=0x20) returned 0x0 [0096.619] IUnknown:Release (This=0x711f0e8) returned 0x3 [0096.619] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.619] GetCurrentThreadId () returned 0x2c8 [0096.619] IUnknown:QueryInterface (in: This=0x711f0e4, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf24 | out: ppvObject=0x2fdf24*=0x711f0e8) returned 0x0 [0096.619] IClientSecurity:QueryBlanket (in: This=0x711f0e8, pProxy=0x711f0e4, pAuthnSvc=0x2fdf14, pAuthzSvc=0x2fdf18, pServerPrincName=0x0, pAuthnLevel=0x2fdf48, pImpLevel=0x2fdf44, pAuthInfo=0x0, pCapabilites=0x2fdf2c | out: pAuthnSvc=0x2fdf14*=0xa, pAuthzSvc=0x2fdf18*=0x0, pServerPrincName=0x0, pAuthnLevel=0x2fdf48*=0x6, pImpLevel=0x2fdf44*=0x3, pAuthInfo=0x0, pCapabilites=0x2fdf2c*=0x20) returned 0x0 [0096.619] IUnknown:Release (This=0x711f0e8) returned 0x3 [0096.619] IUnknown:QueryInterface (in: This=0x712a07c, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdf70 | out: ppvObject=0x2fdf70*=0x712a080) returned 0x0 [0096.620] IClientSecurity:CopyProxy (in: This=0x712a080, pProxy=0x712a07c, ppCopy=0x2fdf74 | out: ppCopy=0x2fdf74*=0x712a144) returned 0x0 [0096.620] IUnknown:QueryInterface (in: This=0x712a144, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde8c | out: ppvObject=0x2fde8c*=0x712a148) returned 0x0 [0096.620] IClientSecurity:QueryBlanket (in: This=0x712a148, pProxy=0x712a144, pAuthnSvc=0x2fdeb0, pAuthzSvc=0x2fdea0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x2fdeb0*=0xa, pAuthzSvc=0x2fdea0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0096.620] IUnknown:Release (This=0x712a148) returned 0x3 [0096.620] IUnknown:QueryInterface (in: This=0x712a144, riid=0x5fb434f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde64 | out: ppvObject=0x2fde64*=0x6c3b24) returned 0x0 [0096.620] IUnknown:QueryInterface (in: This=0x712a144, riid=0x5fb431fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde68 | out: ppvObject=0x2fde68*=0x712a148) returned 0x0 [0096.620] IClientSecurity:SetBlanket (This=0x712a148, pProxy=0x712a144, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.627] IUnknown:Release (This=0x712a148) returned 0x4 [0096.627] WbemLocator:IUnknown:Release (This=0x6c3b24) returned 0x3 [0096.627] IUnknown:Release (This=0x712a080) returned 0x2 [0096.627] IUnknown:AddRef (This=0x712a144) returned 0x3 [0096.627] IUnknown:Release (This=0x712a07c) returned 0x2 [0096.627] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fdfe0 | out: pperrinfo=0x2fdfe0*=0x0) returned 0x1 [0096.627] IUnknown:Release (This=0x711f0e4) returned 0x2 [0096.627] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.627] GetCurrentThreadId () returned 0x2c8 [0096.628] IUnknown:AddRef (This=0x712a144) returned 0x3 [0096.628] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.628] GetCurrentThreadId () returned 0x2c8 [0096.628] IEnumWbemClassObject:Reset (This=0x712a144) returned 0x0 [0096.628] IUnknown:Release (This=0x712a144) returned 0x2 [0096.628] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7126858 [0096.628] IUnknown:Release (This=0x6b8548) returned 0x3 [0096.629] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdac8 | out: pAptType=0x2fdac8*=3) returned 0x0 [0096.629] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.629] CoGetContextToken (in: pToken=0x2fda98 | out: pToken=0x2fda98) returned 0x0 [0096.629] IUnknown:AddRef (This=0x712a144) returned 0x3 [0096.629] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0096.629] GetCurrentThreadId () returned 0x2c8 [0096.629] IEnumWbemClassObject:Next (in: This=0x712a144, lTimeout=-1, uCount=0x1, apObjects=0x2fe68c, puReturned=0x2fe684 | out: apObjects=0x2fe68c*=0x0, puReturned=0x2fe684*=0x0) returned 0x1 [0096.630] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fe640 | out: pperrinfo=0x2fe640*=0x0) returned 0x1 [0096.630] IUnknown:Release (This=0x712a144) returned 0x2 [0096.630] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x2fe684 | out: pperrinfo=0x2fe684*=0x0) returned 0x1 [0096.657] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2fe6cc | out: TokenHandle=0x2fe6cc*=0x3c8) returned 1 [0096.657] GetLastError () returned 0x3f0 [0096.660] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x6a6d48 [0096.660] GetLastError () returned 0x7a [0096.660] GetTokenInformation (in: TokenHandle=0x3c8, TokenInformationClass=0x8, TokenInformation=0x6a6d48, TokenInformationLength=0x4, ReturnLength=0x2fe724 | out: TokenInformation=0x6a6d48, ReturnLength=0x2fe724) returned 1 [0096.660] GetLastError () returned 0x7a [0096.661] DuplicateTokenEx (in: hExistingToken=0x3c8, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x2fe6dc | out: phNewToken=0x2fe6dc*=0x3d8) returned 1 [0096.662] GetLastError () returned 0x7a [0096.662] GetTokenInformation (in: TokenHandle=0x3c8, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2fe724 | out: TokenInformation=0x0, ReturnLength=0x2fe724) returned 0 [0096.662] GetLastError () returned 0x7a [0096.662] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x6a6d28 [0096.662] GetLastError () returned 0x7a [0096.662] GetTokenInformation (in: TokenHandle=0x3c8, TokenInformationClass=0x8, TokenInformation=0x6a6d28, TokenInformationLength=0x4, ReturnLength=0x2fe724 | out: TokenInformation=0x6a6d28, ReturnLength=0x2fe724) returned 1 [0096.662] GetLastError () returned 0x7a [0096.662] CheckTokenMembership (in: TokenHandle=0x3d8, SidToCheck=0x1c1323c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x2fe6b8 | out: IsMember=0x2fe6b8) returned 1 [0096.662] GetLastError () returned 0x7a [0096.663] CloseHandle (hObject=0x3d8) returned 1 [0096.663] GetLastError () returned 0x7a [0096.663] GetTokenInformation (in: TokenHandle=0x3c8, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2fe724 | out: TokenInformation=0x0, ReturnLength=0x2fe724) returned 0 [0096.663] GetLastError () returned 0x7a [0096.663] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x6a6d68 [0096.663] GetLastError () returned 0x7a [0096.663] GetTokenInformation (in: TokenHandle=0x3c8, TokenInformationClass=0x8, TokenInformation=0x6a6d68, TokenInformationLength=0x4, ReturnLength=0x2fe724 | out: TokenInformation=0x6a6d68, ReturnLength=0x2fe724) returned 1 [0096.663] GetLastError () returned 0x7a [0096.663] DuplicateTokenEx (in: hExistingToken=0x3c8, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x2fe6dc | out: phNewToken=0x2fe6dc*=0x3d8) returned 1 [0096.663] GetLastError () returned 0x7a [0096.663] GetTokenInformation (in: TokenHandle=0x3c8, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2fe724 | out: TokenInformation=0x0, ReturnLength=0x2fe724) returned 0 [0096.663] GetLastError () returned 0x7a [0096.663] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x6a6d78 [0096.663] GetLastError () returned 0x7a [0096.663] GetTokenInformation (in: TokenHandle=0x3c8, TokenInformationClass=0x8, TokenInformation=0x6a6d78, TokenInformationLength=0x4, ReturnLength=0x2fe724 | out: TokenInformation=0x6a6d78, ReturnLength=0x2fe724) returned 1 [0096.663] GetLastError () returned 0x7a [0096.663] CheckTokenMembership (in: TokenHandle=0x3d8, SidToCheck=0x1c1332c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x2fe6b8 | out: IsMember=0x2fe6b8) returned 1 [0096.663] GetLastError () returned 0x7a [0096.664] CloseHandle (hObject=0x3d8) returned 1 [0096.664] GetLastError () returned 0x7a [0096.666] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x2fe574 | out: pFixedInfo=0x0, pOutBufLen=0x2fe574) returned 0x6f [0096.682] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6d6148 [0096.682] GetLastError () returned 0x0 [0096.682] GetNetworkParams (in: pFixedInfo=0x6d6148, pOutBufLen=0x2fe574 | out: pFixedInfo=0x6d6148, pOutBufLen=0x2fe574) returned 0x0 [0096.690] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0096.690] GetLastError () returned 0x0 [0096.690] LocalFree (hMem=0x6d6148) returned 0x0 [0096.690] GetLastError () returned 0x0 [0096.690] GetAdaptersAddresses () returned 0x6f [0096.695] LocalAlloc (uFlags=0x0, uBytes=0xad4) returned 0x6d6148 [0096.695] GetLastError () returned 0x0 [0096.695] GetAdaptersAddresses () returned 0x0 [0096.702] LocalFree (hMem=0x6d6148) returned 0x0 [0096.702] GetLastError () returned 0x0 [0096.702] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x2fe634 | out: AdapterInfo=0x0, SizePointer=0x2fe634) returned 0x6f [0096.703] LocalAlloc (uFlags=0x0, uBytes=0x280) returned 0x6d6148 [0096.703] GetLastError () returned 0x0 [0096.703] GetAdaptersInfo (in: AdapterInfo=0x6d6148, SizePointer=0x2fe634 | out: AdapterInfo=0x6d6148, SizePointer=0x2fe634) returned 0x0 [0096.705] inet_addr (cp="192.168.0.219") returned 0xdb00a8c0 [0096.705] GetLastError () returned 0x0 [0096.705] inet_addr (cp="255.255.255.0") returned 0xffffff [0096.705] GetLastError () returned 0x0 [0096.705] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0096.705] GetLastError () returned 0x0 [0096.706] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0096.706] GetLastError () returned 0x0 [0096.706] GetIfEntry (in: pIfRow=0x68b9a8 | out: pIfRow=0x68b9a8) returned 0x0 [0096.706] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x2fe3a8 | out: pPerAdapterInfo=0x0, pOutBufLen=0x2fe3a8) returned 0x6f [0096.712] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x65ad88, pOutBufLen=0x2fe3a8 | out: pPerAdapterInfo=0x65ad88, pOutBufLen=0x2fe3a8) returned 0x0 [0096.719] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0096.719] GetLastError () returned 0x0 [0096.794] CoGetContextToken (in: pToken=0x2fe010 | out: pToken=0x2fe010) returned 0x0 [0096.794] WbemLocator:IUnknown:AddRef (This=0x6c3d04) returned 0x4 [0096.794] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3d04, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe084 | out: ppvObject=0x2fe084*=0x6c3cec) returned 0x0 [0096.794] WbemLocator:IUnknown:Release (This=0x6c3d04) returned 0x4 [0096.794] WbemLocator:IRpcOptions:Query (in: This=0x6c3cec, pPrx=0x6c3d04, dwProperty=2, pdwValue=0x2fe0a8 | out: pdwValue=0x2fe0a8) returned 0x0 [0096.795] WbemLocator:IUnknown:Release (This=0x6c3cec) returned 0x3 [0096.795] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3d04, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe310 | out: ppvObject=0x2fe310*=0x6c3ce4) returned 0x0 [0096.795] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c3ce4, pProxy=0x6c3d04, pAuthnSvc=0x2fe358, pAuthzSvc=0x2fe354, pServerPrincName=0x2fe364, pAuthnLevel=0x2fe35c, pImpLevel=0x2fe348, pAuthInfo=0x2fe34c, pCapabilites=0x2fe350 | out: pAuthnSvc=0x2fe358*=0xa, pAuthzSvc=0x2fe354*=0x0, pServerPrincName=0x2fe364, pAuthnLevel=0x2fe35c*=0x6, pImpLevel=0x2fe348*=0x2, pAuthInfo=0x2fe34c, pCapabilites=0x2fe350*=0x1) returned 0x0 [0096.795] WbemLocator:IUnknown:Release (This=0x6c3ce4) returned 0x2 [0096.795] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3d04, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe304 | out: ppvObject=0x2fe304*=0x6c3d04) returned 0x0 [0096.795] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3d04, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe300 | out: ppvObject=0x2fe300*=0x6c3ce4) returned 0x0 [0096.795] WbemLocator:IClientSecurity:SetBlanket (This=0x6c3ce4, pProxy=0x6c3d04, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.795] WbemLocator:IUnknown:Release (This=0x6c3ce4) returned 0x3 [0096.795] WbemLocator:IUnknown:Release (This=0x6c3d04) returned 0x2 [0096.795] CoTaskMemFree (pv=0x6c0158) [0096.795] WbemLocator:IUnknown:Release (This=0x6c3d04) returned 0x1 [0096.795] SysStringLen (param_1=0x0) returned 0x0 [0096.795] GetLastError () returned 0x0 [0096.795] CoGetContextToken (in: pToken=0x2fe48c | out: pToken=0x2fe48c) returned 0x0 [0096.795] CoGetContextToken (in: pToken=0x2fe44c | out: pToken=0x2fe44c) returned 0x0 [0096.795] WbemLocator:IUnknown:AddRef (This=0x6c3d04) returned 0x2 [0096.795] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3d04, riid=0x2fe4c8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x2fe4c4 | out: ppvObject=0x2fe4c4*=0x711f21c) returned 0x0 [0096.797] WbemLocator:IUnknown:Release (This=0x6c3d04) returned 0x2 [0096.797] WbemLocator:IUnknown:Release (This=0x711f21c) returned 0x1 [0096.797] CoGetContextToken (in: pToken=0x2fe020 | out: pToken=0x2fe020) returned 0x0 [0096.797] CoGetContextToken (in: pToken=0x2fdfe0 | out: pToken=0x2fdfe0) returned 0x0 [0096.797] WbemLocator:IUnknown:AddRef (This=0x6c3d04) returned 0x2 [0096.797] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3d04, riid=0x2fe05c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x2fe058 | out: ppvObject=0x2fe058*=0x711f21c) returned 0x0 [0096.797] WbemLocator:IUnknown:Release (This=0x6c3d04) returned 0x2 [0096.798] WbemLocator:IUnknown:AddRef (This=0x711f21c) returned 0x3 [0096.798] WbemLocator:IUnknown:QueryInterface (in: This=0x711f21c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe310 | out: ppvObject=0x2fe310*=0x6c3ce4) returned 0x0 [0096.798] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c3ce4, pProxy=0x711f21c, pAuthnSvc=0x2fe358, pAuthzSvc=0x2fe354, pServerPrincName=0x2fe364, pAuthnLevel=0x2fe35c, pImpLevel=0x2fe348, pAuthInfo=0x2fe34c, pCapabilites=0x2fe350 | out: pAuthnSvc=0x2fe358*=0xa, pAuthzSvc=0x2fe354*=0x0, pServerPrincName=0x2fe364, pAuthnLevel=0x2fe35c*=0x6, pImpLevel=0x2fe348*=0x2, pAuthInfo=0x2fe34c, pCapabilites=0x2fe350*=0x1) returned 0x0 [0096.798] WbemLocator:IUnknown:Release (This=0x6c3ce4) returned 0x3 [0096.798] WbemLocator:IUnknown:QueryInterface (in: This=0x711f21c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe304 | out: ppvObject=0x2fe304*=0x6c3d04) returned 0x0 [0096.798] WbemLocator:IUnknown:QueryInterface (in: This=0x711f21c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe300 | out: ppvObject=0x2fe300*=0x6c3ce4) returned 0x0 [0096.798] WbemLocator:IClientSecurity:SetBlanket (This=0x6c3ce4, pProxy=0x711f21c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.798] WbemLocator:IUnknown:Release (This=0x6c3ce4) returned 0x4 [0096.798] WbemLocator:IUnknown:Release (This=0x6c3d04) returned 0x3 [0096.798] CoTaskMemFree (pv=0x6c0098) [0096.798] WbemLocator:IUnknown:Release (This=0x711f21c) returned 0x2 [0096.798] SysStringLen (param_1=0x0) returned 0x0 [0096.798] GetLastError () returned 0x0 [0096.798] CoGetContextToken (in: pToken=0x2fddb0 | out: pToken=0x2fddb0) returned 0x0 [0096.798] WbemLocator:IUnknown:AddRef (This=0x711f21c) returned 0x3 [0096.798] IWbemServices:ExecQuery (in: This=0x711f21c, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_VideoController", lFlags=16, pCtx=0x0, ppEnum=0x2fe3f4 | out: ppEnum=0x2fe3f4*=0x712a20c) returned 0x0 [0096.807] IUnknown:QueryInterface (in: This=0x712a20c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe0a0 | out: ppvObject=0x2fe0a0*=0x712a210) returned 0x0 [0096.807] IClientSecurity:QueryBlanket (in: This=0x712a210, pProxy=0x712a20c, pAuthnSvc=0x2fe0e8, pAuthzSvc=0x2fe0e4, pServerPrincName=0x2fe0f4, pAuthnLevel=0x2fe0ec, pImpLevel=0x2fe0d8, pAuthInfo=0x2fe0dc, pCapabilites=0x2fe0e0 | out: pAuthnSvc=0x2fe0e8*=0xa, pAuthzSvc=0x2fe0e4*=0x0, pServerPrincName=0x2fe0f4, pAuthnLevel=0x2fe0ec*=0x6, pImpLevel=0x2fe0d8*=0x2, pAuthInfo=0x2fe0dc, pCapabilites=0x2fe0e0*=0x1) returned 0x0 [0096.807] IUnknown:Release (This=0x712a210) returned 0x1 [0096.807] IUnknown:QueryInterface (in: This=0x712a20c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe094 | out: ppvObject=0x2fe094*=0x6c3ee4) returned 0x0 [0096.807] IUnknown:QueryInterface (in: This=0x712a20c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe090 | out: ppvObject=0x2fe090*=0x712a210) returned 0x0 [0096.807] IClientSecurity:SetBlanket (This=0x712a210, pProxy=0x712a20c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.820] IUnknown:Release (This=0x712a210) returned 0x2 [0096.820] WbemLocator:IUnknown:Release (This=0x6c3ee4) returned 0x1 [0096.820] CoTaskMemFree (pv=0x6c0158) [0096.821] WbemLocator:IUnknown:Release (This=0x711f21c) returned 0x2 [0096.821] IUnknown:QueryInterface (in: This=0x712a20c, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fda4c | out: ppvObject=0x2fda4c*=0x6c3ee4) returned 0x0 [0096.833] WbemLocator:IUnknown:AddRef (This=0x6c3ee4) returned 0x3 [0096.833] CoGetContextToken (in: pToken=0x2fd894 | out: pToken=0x2fd894) returned 0x0 [0096.833] CoGetContextToken (in: pToken=0x2fd858 | out: pToken=0x2fd858) returned 0x0 [0096.833] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd88c | out: ppvObject=0x2fd88c*=0x6484cc) returned 0x0 [0096.833] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fd8bc | out: pAptType=0x2fd8bc*=3) returned 0x0 [0096.833] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.834] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3ee4, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd87c | out: ppvObject=0x2fd87c*=0x6c3e44) returned 0x0 [0096.834] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c3e44, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fd884 | out: pCid=0x2fd884*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0096.834] WbemLocator:IUnknown:Release (This=0x6c3e44) returned 0x3 [0096.834] CoGetContextToken (in: pToken=0x2fd88c | out: pToken=0x2fd88c) returned 0x0 [0096.834] WbemLocator:IUnknown:AddRef (This=0x6c3ee4) returned 0x4 [0096.834] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3ee4, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd900 | out: ppvObject=0x2fd900*=0x6c3ecc) returned 0x0 [0096.834] WbemLocator:IUnknown:Release (This=0x6c3ee4) returned 0x4 [0096.834] WbemLocator:IRpcOptions:Query (in: This=0x6c3ecc, pPrx=0x6c3ee4, dwProperty=2, pdwValue=0x2fd924 | out: pdwValue=0x2fd924) returned 0x80004002 [0096.834] WbemLocator:IUnknown:Release (This=0x6c3ecc) returned 0x3 [0096.834] IEnumWbemClassObject:Clone (in: This=0x712a20c, ppEnum=0x2fe65c | out: ppEnum=0x2fe65c*=0x712a2d4) returned 0x0 [0096.849] IUnknown:QueryInterface (in: This=0x712a2d4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe318 | out: ppvObject=0x2fe318*=0x712a2d8) returned 0x0 [0096.849] IClientSecurity:QueryBlanket (in: This=0x712a2d8, pProxy=0x712a2d4, pAuthnSvc=0x2fe360, pAuthzSvc=0x2fe35c, pServerPrincName=0x2fe36c, pAuthnLevel=0x2fe364, pImpLevel=0x2fe350, pAuthInfo=0x2fe354, pCapabilites=0x2fe358 | out: pAuthnSvc=0x2fe360*=0xa, pAuthzSvc=0x2fe35c*=0x0, pServerPrincName=0x2fe36c, pAuthnLevel=0x2fe364*=0x6, pImpLevel=0x2fe350*=0x2, pAuthInfo=0x2fe354, pCapabilites=0x2fe358*=0x1) returned 0x0 [0096.849] IUnknown:Release (This=0x712a2d8) returned 0x1 [0096.849] IUnknown:QueryInterface (in: This=0x712a2d4, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe30c | out: ppvObject=0x2fe30c*=0x6c40c4) returned 0x0 [0096.849] IUnknown:QueryInterface (in: This=0x712a2d4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe308 | out: ppvObject=0x2fe308*=0x712a2d8) returned 0x0 [0096.849] IClientSecurity:SetBlanket (This=0x712a2d8, pProxy=0x712a2d4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.876] IUnknown:Release (This=0x712a2d8) returned 0x2 [0096.876] WbemLocator:IUnknown:Release (This=0x6c40c4) returned 0x1 [0096.876] CoTaskMemFree (pv=0x6c00f8) [0096.876] IUnknown:Release (This=0x712a20c) returned 0x2 [0096.876] IUnknown:QueryInterface (in: This=0x712a2d4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdcb4 | out: ppvObject=0x2fdcb4*=0x6c40c4) returned 0x0 [0096.883] WbemLocator:IUnknown:AddRef (This=0x6c40c4) returned 0x3 [0096.883] CoGetContextToken (in: pToken=0x2fdafc | out: pToken=0x2fdafc) returned 0x0 [0096.883] CoGetContextToken (in: pToken=0x2fdac0 | out: pToken=0x2fdac0) returned 0x0 [0096.883] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdaf4 | out: ppvObject=0x2fdaf4*=0x6484cc) returned 0x0 [0096.883] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fdb24 | out: pAptType=0x2fdb24*=3) returned 0x0 [0096.883] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.883] WbemLocator:IUnknown:QueryInterface (in: This=0x6c40c4, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdae4 | out: ppvObject=0x2fdae4*=0x6c4024) returned 0x0 [0096.883] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c4024, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fdaec | out: pCid=0x2fdaec*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0096.883] WbemLocator:IUnknown:Release (This=0x6c4024) returned 0x3 [0096.883] CoGetContextToken (in: pToken=0x2fdaf4 | out: pToken=0x2fdaf4) returned 0x0 [0096.883] WbemLocator:IUnknown:AddRef (This=0x6c40c4) returned 0x4 [0096.883] WbemLocator:IUnknown:QueryInterface (in: This=0x6c40c4, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdb68 | out: ppvObject=0x2fdb68*=0x6c40ac) returned 0x0 [0096.883] WbemLocator:IUnknown:Release (This=0x6c40c4) returned 0x4 [0096.883] WbemLocator:IRpcOptions:Query (in: This=0x6c40ac, pPrx=0x6c40c4, dwProperty=2, pdwValue=0x2fdb8c | out: pdwValue=0x2fdb8c) returned 0x80004002 [0096.883] WbemLocator:IUnknown:Release (This=0x6c40ac) returned 0x3 [0096.884] IEnumWbemClassObject:Reset (This=0x712a2d4) returned 0x0 [0096.884] IUnknown:Release (This=0x712a2d4) returned 0x2 [0096.884] CoGetContextToken (in: pToken=0x2fe44c | out: pToken=0x2fe44c) returned 0x0 [0096.884] IUnknown:AddRef (This=0x712a2d4) returned 0x3 [0096.884] IEnumWbemClassObject:Next (in: This=0x712a2d4, lTimeout=-1, uCount=0x1, apObjects=0x650cf0, puReturned=0x1c16d04 | out: apObjects=0x650cf0*=0x711f230, puReturned=0x1c16d04*=0x1) returned 0x0 [0096.887] IUnknown:QueryInterface (in: This=0x711f230, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fda58 | out: ppvObject=0x2fda58*=0x711f230) returned 0x0 [0096.887] IUnknown:AddRef (This=0x711f230) returned 0x3 [0096.887] CoGetContextToken (in: pToken=0x2fd8a0 | out: pToken=0x2fd8a0) returned 0x0 [0096.887] CoGetContextToken (in: pToken=0x2fd864 | out: pToken=0x2fd864) returned 0x0 [0096.887] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd898 | out: ppvObject=0x2fd898*=0x6484cc) returned 0x0 [0096.887] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fd8c8 | out: pAptType=0x2fd8c8*=3) returned 0x0 [0096.887] IUnknown:Release (This=0x6484cc) returned 0x1 [0096.888] IUnknown:QueryInterface (in: This=0x711f230, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd888 | out: ppvObject=0x2fd888*=0x711f234) returned 0x0 [0096.888] IMarshal:GetUnmarshalClass (in: This=0x711f234, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x2fd890 | out: pCid=0x2fd890*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0096.888] IUnknown:Release (This=0x711f234) returned 0x3 [0096.888] CoGetContextToken (in: pToken=0x2fd898 | out: pToken=0x2fd898) returned 0x0 [0096.888] IUnknown:AddRef (This=0x711f230) returned 0x4 [0096.888] IUnknown:QueryInterface (in: This=0x711f230, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fd90c | out: ppvObject=0x2fd90c*=0x0) returned 0x80004002 [0096.888] IUnknown:Release (This=0x711f230) returned 0x3 [0096.888] IWbemClassObject:Get (in: This=0x711f230, wszName="__GENUS", lFlags=0, pVal=0x2fe65c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2fe710*=0, plFlavor=0x2fe70c*=0 | out: pVal=0x2fe65c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2fe710*=3, plFlavor=0x2fe70c*=64) returned 0x0 [0096.888] IWbemClassObject:Get (in: This=0x711f230, wszName="__PATH", lFlags=0, pVal=0x2fe63c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2fe6f4*=0, plFlavor=0x2fe6f0*=0 | out: pVal=0x2fe63c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\ARRARNMKU\\root\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"", varVal2=0x0), pType=0x2fe6f4*=8, plFlavor=0x2fe6f0*=64) returned 0x0 [0096.888] SysStringLen (param_1="\\\\ARRARNMKU\\root\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x48 [0096.888] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f4 [0096.888] GetLastError () returned 0x0 [0096.888] SetEvent (hEvent=0x27c) returned 1 [0096.889] GetLastError () returned 0x0 [0096.889] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2fe658*=0x3f4, lpdwindex=0x2fe410 | out: lpdwindex=0x2fe410) returned 0x0 [0096.891] CoGetContextToken (in: pToken=0x2fe4a8 | out: pToken=0x2fe4a8) returned 0x0 [0096.891] CoGetContextToken (in: pToken=0x2fe468 | out: pToken=0x2fe468) returned 0x0 [0096.891] WbemDefPath:IUnknown:AddRef (This=0x711f560) returned 0x2 [0096.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x711f560, riid=0x2fe4e4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe4e0 | out: ppvObject=0x2fe4e0*=0x711f560) returned 0x0 [0096.891] WbemDefPath:IUnknown:Release (This=0x711f560) returned 0x2 [0096.891] WbemDefPath:IUnknown:Release (This=0x711f560) returned 0x1 [0096.891] CoGetContextToken (in: pToken=0x2fe528 | out: pToken=0x2fe528) returned 0x0 [0096.891] CoGetContextToken (in: pToken=0x2fe4e8 | out: pToken=0x2fe4e8) returned 0x0 [0096.891] WbemDefPath:IUnknown:AddRef (This=0x711f560) returned 0x2 [0096.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x711f560, riid=0x2fe564*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe560 | out: ppvObject=0x2fe560*=0x711f560) returned 0x0 [0096.891] WbemDefPath:IUnknown:Release (This=0x711f560) returned 0x2 [0096.891] WbemDefPath:IWbemPath:SetText (This=0x711f560, uMode=0x4, pszPath="\\\\ARRARNMKU\\root\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x0 [0096.891] WbemDefPath:IUnknown:Release (This=0x711f560) returned 0x1 [0096.891] CoGetContextToken (in: pToken=0x2fe514 | out: pToken=0x2fe514) returned 0x0 [0096.891] CoGetContextToken (in: pToken=0x2fe4d4 | out: pToken=0x2fe4d4) returned 0x0 [0096.891] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0096.891] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe54c | out: ppvObject=0x2fe54c*=0x71108b8) returned 0x0 [0096.892] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0096.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x71108b8, puCount=0x2fe6c8 | out: puCount=0x2fe6c8*=0x2) returned 0x0 [0096.892] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0096.892] CoGetContextToken (in: pToken=0x2fe504 | out: pToken=0x2fe504) returned 0x0 [0096.892] CoGetContextToken (in: pToken=0x2fe4c4 | out: pToken=0x2fe4c4) returned 0x0 [0096.892] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0096.892] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe540*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe53c | out: ppvObject=0x2fe53c*=0x71108b8) returned 0x0 [0096.892] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0096.892] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe6c4*=0x0, pszText=0x0 | out: puBuffLength=0x2fe6c4*=0xf, pszText=0x0) returned 0x0 [0096.892] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0096.892] CoGetContextToken (in: pToken=0x2fe504 | out: pToken=0x2fe504) returned 0x0 [0096.892] CoGetContextToken (in: pToken=0x2fe4c4 | out: pToken=0x2fe4c4) returned 0x0 [0096.892] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0096.892] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x2fe540*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe53c | out: ppvObject=0x2fe53c*=0x71108b8) returned 0x0 [0096.893] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0096.893] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x2fe6c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x2fe6c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0096.893] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0096.893] IWbemClassObject:Get (in: This=0x711f230, wszName="Name", lFlags=0, pVal=0x2fe65c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c1765c*=0, plFlavor=0x1c17660*=0 | out: pVal=0x2fe65c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x1c1765c*=8, plFlavor=0x1c17660*=0) returned 0x0 [0096.893] SysStringLen (param_1="Standard VGA Graphics Adapter") returned 0x1d [0096.893] IWbemClassObject:Get (in: This=0x711f230, wszName="Name", lFlags=0, pVal=0x2fe660*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c1765c*=8, plFlavor=0x1c17660*=0 | out: pVal=0x2fe660*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x1c1765c*=8, plFlavor=0x1c17660*=0) returned 0x0 [0096.893] SysStringLen (param_1="Standard VGA Graphics Adapter") returned 0x1d [0096.893] CoGetContextToken (in: pToken=0x2fe44c | out: pToken=0x2fe44c) returned 0x0 [0096.893] IUnknown:AddRef (This=0x712a2d4) returned 0x3 [0096.893] IEnumWbemClassObject:Next (in: This=0x712a2d4, lTimeout=-1, uCount=0x1, apObjects=0x650cf0, puReturned=0x1c16d04 | out: apObjects=0x650cf0*=0x0, puReturned=0x1c16d04*=0x0) returned 0x1 [0096.894] IUnknown:Release (This=0x712a2d4) returned 0x2 [0096.947] GetSystemPowerStatus (in: lpSystemPowerStatus=0x2fe730 | out: lpSystemPowerStatus=0x2fe730) returned 1 [0096.947] GetLastError () returned 0x0 [0097.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x2fe254, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0097.060] GetLastError () returned 0x0 [0097.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x2fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0097.061] GetLastError () returned 0x0 [0097.068] DeleteFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe:Zone.Identifier" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe:zone.identifier")) returned 0 [0097.069] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="a403e9b3-6f76-41ac-ab55-e693040d1b8b") returned 0x400 [0097.069] GetLastError () returned 0xb7 [0097.069] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x2fe74c*=0x400, lpdwindex=0x2fe504 | out: lpdwindex=0x2fe504) returned 0x0 [0098.315] CoGetClassObject (in: rclsid=0x6d14d4*(Data1=0x62be5d10, Data2=0x60eb, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), dwClsContext=0x15, pvReserved=0x0, riid=0x6254a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x2fe3e8 | out: ppv=0x2fe3e8*=0x60726d0) returned 0x0 [0098.573] SystemDeviceEnum:IUnknown:QueryInterface (in: This=0x60726d0, riid=0x62637ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fe218 | out: ppvObject=0x2fe218*=0x0) returned 0x80004002 [0098.574] SystemDeviceEnum:IClassFactory:CreateInstance (in: This=0x60726d0, pUnkOuter=0x0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fe250 | out: ppvObject=0x2fe250*=0x6072700) returned 0x0 [0098.696] SystemDeviceEnum:IUnknown:QueryInterface (in: This=0x6072700, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdff4 | out: ppvObject=0x2fdff4*=0x6072700) returned 0x0 [0098.697] SystemDeviceEnum:IUnknown:QueryInterface (in: This=0x6072700, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x2fdfb0 | out: ppvObject=0x2fdfb0*=0x0) returned 0x80004002 [0098.697] SystemDeviceEnum:IUnknown:QueryInterface (in: This=0x6072700, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x2fdea4 | out: ppvObject=0x2fdea4*=0x0) returned 0x80004002 [0098.697] SystemDeviceEnum:IUnknown:AddRef (This=0x6072700) returned 0x3 [0098.697] CoGetContextToken (in: pToken=0x2fde3c | out: pToken=0x2fde3c) returned 0x0 [0098.697] CoGetContextToken (in: pToken=0x2fde00 | out: pToken=0x2fde00) returned 0x0 [0098.697] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde34 | out: ppvObject=0x2fde34*=0x6484cc) returned 0x0 [0098.697] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6484cc, pAptType=0x2fde64 | out: pAptType=0x2fde64*=3) returned 0x0 [0098.697] IUnknown:Release (This=0x6484cc) returned 0x1 [0098.697] SystemDeviceEnum:IUnknown:QueryInterface (in: This=0x6072700, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fde24 | out: ppvObject=0x2fde24*=0x0) returned 0x80004002 [0098.698] CoGetContextToken (in: pToken=0x2fde34 | out: pToken=0x2fde34) returned 0x0 [0098.698] SystemDeviceEnum:IUnknown:AddRef (This=0x6072700) returned 0x4 [0098.698] SystemDeviceEnum:IUnknown:QueryInterface (in: This=0x6072700, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2fdea8 | out: ppvObject=0x2fdea8*=0x0) returned 0x80004002 [0098.698] SystemDeviceEnum:IUnknown:Release (This=0x6072700) returned 0x3 [0098.698] SystemDeviceEnum:IUnknown:Release (This=0x6072700) returned 0x2 [0098.698] SystemDeviceEnum:IUnknown:Release (This=0x60726d0) returned 0x1 [0098.698] SystemDeviceEnum:IUnknown:Release (This=0x6072700) returned 0x1 [0098.698] CoGetContextToken (in: pToken=0x2fe4bc | out: pToken=0x2fe4bc) returned 0x0 [0098.698] IIDFromString (in: lpsz="{29840822-5B84-11D0-BD3B-00A0C911CE86}", lpiid=0x2fe4f8 | out: lpiid=0x2fe4f8) returned 0x0 [0098.698] CoGetContextToken (in: pToken=0x2fe47c | out: pToken=0x2fe47c) returned 0x0 [0098.698] SystemDeviceEnum:IUnknown:AddRef (This=0x6072700) returned 0x2 [0098.698] SystemDeviceEnum:IUnknown:QueryInterface (in: This=0x6072700, riid=0x2fe4f8*(Data1=0x29840822, Data2=0x5b84, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), ppvObject=0x2fe4f4 | out: ppvObject=0x2fe4f4*=0x6072700) returned 0x0 [0098.699] SystemDeviceEnum:IUnknown:Release (This=0x6072700) returned 0x2 [0098.699] SystemDeviceEnum:IUnknown:Release (This=0x6072700) returned 0x1 [0098.699] CoGetContextToken (in: pToken=0x2fe48c | out: pToken=0x2fe48c) returned 0x0 [0098.699] CoGetContextToken (in: pToken=0x2fe44c | out: pToken=0x2fe44c) returned 0x0 [0098.699] SystemDeviceEnum:IUnknown:AddRef (This=0x6072700) returned 0x2 [0098.699] SystemDeviceEnum:IUnknown:QueryInterface (in: This=0x6072700, riid=0x2fe4c8*(Data1=0x29840822, Data2=0x5b84, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), ppvObject=0x2fe4c4 | out: ppvObject=0x2fe4c4*=0x6072700) returned 0x0 [0098.699] SystemDeviceEnum:IUnknown:Release (This=0x6072700) returned 0x2 [0098.699] SystemDeviceEnum:IUnknown:AddRef (This=0x6072700) returned 0x3 [0098.699] SystemDeviceEnum:ICreateDevEnum:CreateClassEnumerator (in: This=0x6072700, clsidDeviceClass=0x2fe748*(Data1=0x860bb310, Data2=0x5d01, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), ppenumMoniker=0x2fe5f8, dwFlags=0x0 | out: ppenumMoniker=0x2fe5f8*=0x0) returned 0x1 [0100.128] SystemDeviceEnum:IUnknown:Release (This=0x6072700) returned 0x2 [0100.132] CoGetContextToken (in: pToken=0x2fe568 | out: pToken=0x2fe568) returned 0x0 [0100.132] SystemDeviceEnum:IUnknown:Release (This=0x6072700) returned 0x1 [0100.132] SystemDeviceEnum:IUnknown:Release (This=0x6072700) returned 0x0 [0100.196] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1c2 [0100.196] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc17c [0100.198] AdjustWindowRectEx (in: lpRect=0x2fe734, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2fe734) returned 1 [0100.199] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75d30000 [0100.200] GetProcAddress (hModule=0x75d30000, lpProcName="DefWindowProcW") returned 0x75d4507d [0100.200] GetStockObject (i=5) returned 0x1900015 [0100.200] GetLastError () returned 0x0 [0100.200] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0100.201] CoTaskMemAlloc (cb=0x4c) returned 0x6d8df0 [0100.201] RegisterClassW (lpWndClass=0x650cf0) returned 0xc17b [0100.201] GetLastError () returned 0x0 [0100.201] CoTaskMemFree (pv=0x6d8df0) [0100.201] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0100.202] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x20244 [0100.202] SetWindowLongW (hWnd=0x20244, nIndex=-4, dwNewLong=1976848509) returned 858250 [0100.202] GetWindowLongW (hWnd=0x20244, nIndex=-4) returned 1976848509 [0100.204] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc17a [0100.204] CallWindowProcW (lpPrevWndFunc=0x75d4507d, hWnd=0x20244, Msg=0x24, wParam=0x0, lParam=0x2fe044) returned 0x0 [0100.204] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1c0 [0100.204] CallWindowProcW (lpPrevWndFunc=0x75d4507d, hWnd=0x20244, Msg=0x81, wParam=0x0, lParam=0x2fdfec) returned 0x1 [0100.204] CallWindowProcW (lpPrevWndFunc=0x75d4507d, hWnd=0x20244, Msg=0x83, wParam=0x0, lParam=0x2fe064) returned 0x0 [0100.204] CallWindowProcW (lpPrevWndFunc=0x75d4507d, hWnd=0x20244, Msg=0x1, wParam=0x0, lParam=0x2fdfec) returned 0x0 [0100.205] GetClientRect (in: hWnd=0x20244, lpRect=0x2fdd7c | out: lpRect=0x2fdd7c) returned 1 [0100.205] GetWindowRect (in: hWnd=0x20244, lpRect=0x2fdd7c | out: lpRect=0x2fdd7c) returned 1 [0100.205] GetLastError () returned 0x7f [0100.205] GetParent (hWnd=0x20244) returned 0x0 [0100.247] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x68b9a8 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0100.248] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2fe258, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0100.248] GetLastError () returned 0x3f0 [0100.256] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x68b9a8 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0100.257] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2fe258, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0100.257] GetLastError () returned 0x3f0 [0100.261] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x68b9a8 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0100.261] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2fe258, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0100.261] GetLastError () returned 0x3f0 [0100.276] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x68b9a8 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0100.276] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2fe254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0100.276] GetLastError () returned 0x3f0 [0100.278] GetModuleHandleW (lpModuleName="0") returned 0x0 [0100.278] GetLastError () returned 0x7e [0100.279] SetWindowsHookExA (idHook=13, lpfn=0xd18ea, hmod=0x0, dwThreadId=0x0) returned 0x601c1 [0100.310] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x68b9a8 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0100.310] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2fe254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0100.310] GetLastError () returned 0x3f0 [0100.311] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x2fe568 | out: pFixedInfo=0x0, pOutBufLen=0x2fe568) returned 0x6f [0100.412] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6df0d0 [0100.412] GetLastError () returned 0x0 [0100.413] GetNetworkParams (in: pFixedInfo=0x6df0d0, pOutBufLen=0x2fe568 | out: pFixedInfo=0x6df0d0, pOutBufLen=0x2fe568) returned 0x0 [0100.419] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0100.419] GetLastError () returned 0x0 [0100.419] LocalFree (hMem=0x6df0d0) returned 0x0 [0100.419] GetLastError () returned 0x0 [0100.419] GetAdaptersAddresses () returned 0x6f [0100.424] LocalAlloc (uFlags=0x0, uBytes=0xad4) returned 0x6e93a0 [0100.424] GetLastError () returned 0x0 [0100.424] GetAdaptersAddresses () returned 0x0 [0100.429] LocalFree (hMem=0x6e93a0) returned 0x0 [0100.429] GetLastError () returned 0x0 [0100.429] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x2fe628 | out: AdapterInfo=0x0, SizePointer=0x2fe628) returned 0x6f [0100.431] LocalAlloc (uFlags=0x0, uBytes=0x280) returned 0x6df0d0 [0100.431] GetLastError () returned 0x0 [0100.431] GetAdaptersInfo (in: AdapterInfo=0x6df0d0, SizePointer=0x2fe628 | out: AdapterInfo=0x6df0d0, SizePointer=0x2fe628) returned 0x0 [0100.433] inet_addr (cp="192.168.0.219") returned 0xdb00a8c0 [0100.433] GetLastError () returned 0x0 [0100.433] inet_addr (cp="255.255.255.0") returned 0xffffff [0100.433] GetLastError () returned 0x0 [0100.433] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0100.433] GetLastError () returned 0x0 [0100.433] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0100.433] GetLastError () returned 0x0 [0100.433] GetIfEntry (in: pIfRow=0x68b9a8 | out: pIfRow=0x68b9a8) returned 0x0 [0100.434] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x2fe39c | out: pPerAdapterInfo=0x0, pOutBufLen=0x2fe39c) returned 0x6f [0100.440] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x65aff8 [0100.440] GetLastError () returned 0x0 [0100.440] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x65aff8, pOutBufLen=0x2fe39c | out: pPerAdapterInfo=0x65aff8, pOutBufLen=0x2fe39c) returned 0x0 [0100.446] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0100.446] GetLastError () returned 0x0 [0100.446] LocalFree (hMem=0x65aff8) returned 0x0 [0100.446] GetLastError () returned 0x0 [0100.446] LocalFree (hMem=0x6df0d0) returned 0x0 [0100.446] GetLastError () returned 0x0 [0100.446] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x2fe570 | out: pFixedInfo=0x0, pOutBufLen=0x2fe570) returned 0x6f [0100.516] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6df0d0 [0100.516] GetLastError () returned 0x0 [0100.516] GetNetworkParams (in: pFixedInfo=0x6df0d0, pOutBufLen=0x2fe570 | out: pFixedInfo=0x6df0d0, pOutBufLen=0x2fe570) returned 0x0 [0100.523] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0100.523] GetLastError () returned 0x0 [0100.523] LocalFree (hMem=0x6df0d0) returned 0x0 [0100.523] GetLastError () returned 0x0 [0100.523] GetAdaptersAddresses () returned 0x6f [0100.527] LocalAlloc (uFlags=0x0, uBytes=0xad4) returned 0x6e93a0 [0100.527] GetLastError () returned 0x0 [0100.527] GetAdaptersAddresses () returned 0x0 [0100.533] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x2fe630 | out: AdapterInfo=0x0, SizePointer=0x2fe630) returned 0x6f [0100.535] GetAdaptersInfo (in: AdapterInfo=0x6df0d0, SizePointer=0x2fe630 | out: AdapterInfo=0x6df0d0, SizePointer=0x2fe630) returned 0x0 [0100.536] inet_addr (cp="192.168.0.219") returned 0xdb00a8c0 [0100.536] GetLastError () returned 0x0 [0100.536] inet_addr (cp="255.255.255.0") returned 0xffffff [0100.536] GetLastError () returned 0x0 [0100.537] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0100.537] GetLastError () returned 0x0 [0100.537] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0100.537] GetLastError () returned 0x0 [0100.537] GetIfEntry (in: pIfRow=0x68b9a8 | out: pIfRow=0x68b9a8) returned 0x0 [0100.537] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x2fe3a4 | out: pPerAdapterInfo=0x0, pOutBufLen=0x2fe3a4) returned 0x6f [0100.543] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x65aff8, pOutBufLen=0x2fe3a4 | out: pPerAdapterInfo=0x65aff8, pOutBufLen=0x2fe3a4) returned 0x0 [0100.549] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0100.549] GetLastError () returned 0x0 [0100.552] GetIfEntry (in: pIfRow=0x68b9a8 | out: pIfRow=0x68b9a8) returned 0x0 [0100.553] GetIfEntry (in: pIfRow=0x68b9a8 | out: pIfRow=0x68b9a8) returned 0x0 [0100.553] GetIfEntry (in: pIfRow=0x68b9a8 | out: pIfRow=0x68b9a8) returned 0x0 [0100.553] GetIfEntry (in: pIfRow=0x68b9a8 | out: pIfRow=0x68b9a8) returned 0x0 [0100.553] GetIfEntry (in: pIfRow=0x68b9a8 | out: pIfRow=0x68b9a8) returned 0x0 [0100.553] GetIfEntry (in: pIfRow=0x68b9a8 | out: pIfRow=0x68b9a8) returned 0x0 [0100.577] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x2fe6bc*=0x4ac, lpdwindex=0x2fe474 | out: lpdwindex=0x2fe474) returned 0x0 [0100.580] CoGetContextToken (in: pToken=0x2fe50c | out: pToken=0x2fe50c) returned 0x0 [0100.580] CoGetContextToken (in: pToken=0x2fe4cc | out: pToken=0x2fe4cc) returned 0x0 [0100.580] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x2 [0100.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x2fe548*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe544 | out: ppvObject=0x2fe544*=0x7131b58) returned 0x0 [0100.580] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.580] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x1 [0100.580] CoGetContextToken (in: pToken=0x2fe58c | out: pToken=0x2fe58c) returned 0x0 [0100.580] CoGetContextToken (in: pToken=0x2fe54c | out: pToken=0x2fe54c) returned 0x0 [0100.580] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x2 [0100.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x2fe5c8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe5c4 | out: ppvObject=0x2fe5c4*=0x7131b58) returned 0x0 [0100.581] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.581] WbemDefPath:IWbemPath:SetText (This=0x7131b58, uMode=0x4, pszPath="Win32_PerfFormattedData_PerfOS_Processor.Name='_Total'") returned 0x0 [0100.581] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x1 [0100.581] CoGetContextToken (in: pToken=0x2fe578 | out: pToken=0x2fe578) returned 0x0 [0100.581] CoGetContextToken (in: pToken=0x2fe538 | out: pToken=0x2fe538) returned 0x0 [0100.581] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x2 [0100.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x2fe5b4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe5b0 | out: ppvObject=0x2fe5b0*=0x7131b58) returned 0x0 [0100.581] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.581] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x2fe72c | out: puCount=0x2fe72c*=0x0) returned 0x0 [0100.581] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x1 [0100.581] CoGetContextToken (in: pToken=0x2fe568 | out: pToken=0x2fe568) returned 0x0 [0100.581] CoGetContextToken (in: pToken=0x2fe528 | out: pToken=0x2fe528) returned 0x0 [0100.581] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x2 [0100.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x2fe5a4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe5a0 | out: ppvObject=0x2fe5a0*=0x7131b58) returned 0x0 [0100.581] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.581] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x2fe728*=0x0, pszText=0x0 | out: puBuffLength=0x2fe728*=0x37, pszText=0x0) returned 0x0 [0100.582] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x1 [0100.582] CoGetContextToken (in: pToken=0x2fe568 | out: pToken=0x2fe568) returned 0x0 [0100.582] CoGetContextToken (in: pToken=0x2fe528 | out: pToken=0x2fe528) returned 0x0 [0100.582] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x2 [0100.582] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x2fe5a4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe5a0 | out: ppvObject=0x2fe5a0*=0x7131b58) returned 0x0 [0100.582] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.582] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x2fe728*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x2fe728*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0100.582] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x1 [0100.582] CoGetContextToken (in: pToken=0x2fe57c | out: pToken=0x2fe57c) returned 0x0 [0100.582] CoGetContextToken (in: pToken=0x2fe53c | out: pToken=0x2fe53c) returned 0x0 [0100.582] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x2 [0100.582] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x2fe5b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe5b4 | out: ppvObject=0x2fe5b4*=0x7131b58) returned 0x0 [0100.582] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.582] WbemDefPath:IWbemPath:GetInfo (in: This=0x7131b58, uRequestedInfo=0x0, puResponse=0x2fe730 | out: puResponse=0x2fe730*=0xc19) returned 0x0 [0100.582] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x1 [0100.582] CoGetContextToken (in: pToken=0x2fe578 | out: pToken=0x2fe578) returned 0x0 [0100.582] CoGetContextToken (in: pToken=0x2fe538 | out: pToken=0x2fe538) returned 0x0 [0100.583] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x2 [0100.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x2fe5b4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe5b0 | out: ppvObject=0x2fe5b0*=0x7131b58) returned 0x0 [0100.583] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.583] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x2fe72c | out: puCount=0x2fe72c*=0x0) returned 0x0 [0100.583] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x1 [0100.583] CoGetContextToken (in: pToken=0x2fe57c | out: pToken=0x2fe57c) returned 0x0 [0100.583] CoGetContextToken (in: pToken=0x2fe53c | out: pToken=0x2fe53c) returned 0x0 [0100.583] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x2 [0100.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x2fe5b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe5b4 | out: ppvObject=0x2fe5b4*=0x7131b58) returned 0x0 [0100.583] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.583] WbemDefPath:IWbemPath:GetInfo (in: This=0x7131b58, uRequestedInfo=0x0, puResponse=0x2fe730 | out: puResponse=0x2fe730*=0xc19) returned 0x0 [0100.583] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x1 [0100.583] CoGetContextToken (in: pToken=0x2fe57c | out: pToken=0x2fe57c) returned 0x0 [0100.583] CoGetContextToken (in: pToken=0x2fe53c | out: pToken=0x2fe53c) returned 0x0 [0100.583] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x2 [0100.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x2fe5b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x2fe5b4 | out: ppvObject=0x2fe5b4*=0x7131b58) returned 0x0 [0100.583] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.584] WbemDefPath:IWbemPath:GetInfo (in: This=0x7131b58, uRequestedInfo=0x0, puResponse=0x2fe730 | out: puResponse=0x2fe730*=0xc19) returned 0x0 [0100.584] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x1 [0100.613] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\monitoring\\network.dat"), fInfoLevelId=0x0, lpFileInformation=0x2fe724 | out: lpFileInformation=0x2fe724*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.613] GetLastError () returned 0x3 [0100.613] SetErrorMode (uMode=0x0) returned 0x1 [0100.618] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\monitoring\\system.dat"), fInfoLevelId=0x0, lpFileInformation=0x2fe724 | out: lpFileInformation=0x2fe724*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.618] GetLastError () returned 0x3 [0100.618] SetErrorMode (uMode=0x0) returned 0x1 [0101.083] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x2fdf98 | out: lpLuid=0x2fdf98*(LowPart=0x14, HighPart=0)) returned 1 [0101.084] GetLastError () returned 0x0 [0101.085] GetCurrentProcess () returned 0xffffffff [0101.085] GetLastError () returned 0x0 [0101.086] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x2fdf94 | out: TokenHandle=0x2fdf94*=0x3b8) returned 1 [0101.086] GetLastError () returned 0x0 [0101.088] AdjustTokenPrivileges (in: TokenHandle=0x3b8, DisableAllPrivileges=0, NewState=0x1c4aafc*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0101.088] GetLastError () returned 0x514 [0101.089] CloseHandle (hObject=0x3b8) returned 1 [0101.089] GetLastError () returned 0x514 [0101.090] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x24c) returned 0x3b8 [0101.090] GetLastError () returned 0x514 [0101.092] SetProcessWorkingSetSize (hProcess=0x3b8, dwMinimumWorkingSetSize=0xffffffff, dwMaximumWorkingSetSize=0xffffffff) returned 1 [0102.134] GetLastError () returned 0x514 [0102.153] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\control.exe", ulOptions=0x0, samDesired=0x20019, phkResult=0x2fe714 | out: phkResult=0x2fe714*=0x0) returned 0x2 [0102.299] GetCurrentProcessId () returned 0x24c [0102.299] OpenProcess (dwDesiredAccess=0x100000, bInheritHandle=0, dwProcessId=0x24c) returned 0x538 [0102.299] GetLastError () returned 0x514 [0102.300] GetCurrentProcess () returned 0xffffffff [0102.300] GetLastError () returned 0x514 [0102.300] GetCurrentProcess () returned 0xffffffff [0102.300] GetLastError () returned 0x514 [0102.302] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x538, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x2fe728, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x2fe728*=0x578) returned 1 [0102.302] GetLastError () returned 0x514 [0102.303] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0x7fffffff, cHandles=0x1, pHandles=0x2fe750*=0x578, lpdwindex=0x2fe508) [0121.125] CoGetContextToken (in: pToken=0x2fda8c | out: pToken=0x2fda8c) returned 0x0 [0121.125] CoGetContextToken (in: pToken=0x2fda5c | out: pToken=0x2fda5c) returned 0x0 [0121.125] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.125] WbemLocator:IUnknown:Release (This=0x6a63ac) returned 0x1 [0121.125] WbemLocator:IUnknown:Release (This=0x7110b9c) returned 0x0 [0121.126] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.126] IUnknown:Release (This=0x711cbf8) returned 0x1 [0121.126] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.126] IUnknown:Release (This=0x71229a8) returned 0x1 [0121.126] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.126] IUnknown:Release (This=0x65c998) returned 0x1 [0121.126] IUnknown:Release (This=0x65c998) returned 0x0 [0121.126] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.126] IUnknown:Release (This=0x6b4160) returned 0x1 [0121.126] IUnknown:Release (This=0x6b4160) returned 0x0 [0121.126] IUnknown:Release (This=0x7125e58) returned 0x3 [0121.127] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.127] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.127] IUnknown:Release (This=0x7126e84) returned 0x1 [0121.127] IUnknown:Release (This=0x7126e84) returned 0x0 [0121.227] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.227] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.227] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.227] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.228] IUnknown:Release (This=0x6b8548) returned 0x2 [0121.228] IUnknown:Release (This=0x6b85a0) returned 0x3 [0121.228] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.228] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.228] WbemLocator:IUnknown:Release (This=0x7126c6c) returned 0x2 [0121.228] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.228] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.228] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.228] IUnknown:Release (This=0x6b8498) returned 0x2 [0121.228] IUnknown:Release (This=0x6b846c) returned 0x3 [0121.228] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.228] IUnknown:Release (This=0x711cf94) returned 0x1 [0121.228] IUnknown:Release (This=0x711cf94) returned 0x0 [0121.345] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.345] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.345] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.345] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.345] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.345] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.345] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.346] IUnknown:Release (This=0x711cfd0) returned 0x1 [0121.346] WbemLocator:IUnknown:Release (This=0x7126c6c) returned 0x1 [0121.346] WbemLocator:IUnknown:Release (This=0x7126c6c) returned 0x0 [0121.358] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.358] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.358] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.358] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.358] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.358] IUnknown:Release (This=0x711cfd0) returned 0x0 [0121.358] IUnknown:Release (This=0x6b85f8) returned 0x0 [0121.358] IUnknown:Release (This=0x6b85cc) returned 0x0 [0121.358] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.358] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.358] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.358] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.358] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.359] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.359] IUnknown:Release (This=0x65ca18) returned 0x1 [0121.359] IUnknown:Release (This=0x65ca18) returned 0x0 [0121.359] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.359] IUnknown:Release (This=0x6c50d0) returned 0x1 [0121.359] IUnknown:Release (This=0x6c50d0) returned 0x0 [0121.359] IUnknown:Release (This=0x71296f0) returned 0x5 [0121.359] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.359] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.359] IUnknown:Release (This=0x71299bc) returned 0x1 [0121.359] IUnknown:Release (This=0x71299bc) returned 0x0 [0121.364] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.364] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.364] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.364] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.364] IUnknown:Release (This=0x6b8548) returned 0x1 [0121.364] IUnknown:Release (This=0x6b85a0) returned 0x2 [0121.364] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.364] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.365] IUnknown:Release (This=0x7129c04) returned 0x1 [0121.365] IUnknown:Release (This=0x7129c04) returned 0x0 [0121.391] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.392] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.392] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.392] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.392] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.392] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.392] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.392] IUnknown:Release (This=0x65ca58) returned 0x1 [0121.392] IUnknown:Release (This=0x65ca58) returned 0x0 [0121.392] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.392] IUnknown:Release (This=0x6c5828) returned 0x1 [0121.392] IUnknown:Release (This=0x6c5828) returned 0x0 [0121.392] IUnknown:Release (This=0x7129eb0) returned 0x1 [0121.392] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.392] WbemLocator:IUnknown:Release (This=0x711e9ac) returned 0x1 [0121.393] WbemLocator:IUnknown:Release (This=0x711e9ac) returned 0x0 [0121.532] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.532] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.532] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.532] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.532] IUnknown:Release (This=0x6b846c) returned 0x2 [0121.532] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.532] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.532] IUnknown:Release (This=0x711ea4c) returned 0x1 [0121.533] IUnknown:Release (This=0x711ea4c) returned 0x0 [0121.703] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.703] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.703] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.704] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.704] IUnknown:Release (This=0x6b85a0) returned 0x1 [0121.704] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.704] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.704] WbemLocator:IUnknown:Release (This=0x71298bc) returned 0x1 [0121.704] WbemLocator:IUnknown:Release (This=0x71298bc) returned 0x0 [0121.797] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.797] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.797] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.797] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.797] IUnknown:Release (This=0x6b8498) returned 0x1 [0121.797] IUnknown:Release (This=0x6b846c) returned 0x1 [0121.797] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.797] IUnknown:Release (This=0x711ec94) returned 0x1 [0121.798] IUnknown:Release (This=0x711ec94) returned 0x0 [0121.937] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.938] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.938] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.938] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.938] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.938] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0121.938] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.938] IUnknown:Release (This=0x65ca98) returned 0x1 [0121.938] IUnknown:Release (This=0x65ca98) returned 0x0 [0121.938] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.938] IUnknown:Release (This=0x6d0b48) returned 0x1 [0121.938] IUnknown:Release (This=0x6d0b48) returned 0x0 [0121.938] IUnknown:Release (This=0x711eed8) returned 0x3 [0121.939] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.939] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0121.939] IUnknown:Release (This=0x711f0e4) returned 0x1 [0121.939] IUnknown:Release (This=0x711f0e4) returned 0x0 [0122.124] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.125] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.125] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.125] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.125] IUnknown:Release (This=0x6b8548) returned 0x0 [0122.125] IUnknown:Release (This=0x6b85a0) returned 0x0 [0122.125] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.125] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0122.125] WbemLocator:IUnknown:Release (This=0x711f044) returned 0x1 [0122.125] WbemLocator:IUnknown:Release (This=0x711f044) returned 0x0 [0122.218] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.218] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.218] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.218] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.218] IUnknown:Release (This=0x6b8498) returned 0x0 [0122.218] IUnknown:Release (This=0x6b846c) returned 0x0 [0122.220] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.220] IUnknown:Release (This=0x712a144) returned 0x1 [0122.220] IUnknown:Release (This=0x712a144) returned 0x0 [0122.300] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.300] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.300] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.300] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.300] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.300] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.301] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0122.301] WbemLocator:IUnknown:Release (This=0x6c3d04) returned 0x1 [0122.301] WbemLocator:IUnknown:Release (This=0x711f21c) returned 0x0 [0122.301] CoGetContextToken (in: pToken=0x2fd9ec | out: pToken=0x2fd9ec) returned 0x0 [0122.301] IUnknown:Release (This=0x711f230) returned 0x1 [0122.302] CoGetContextToken (in: pToken=0x2fdb1c | out: pToken=0x2fdb1c) returned 0x0 [0122.302] CoGetContextToken (in: pToken=0x2fdae8 | out: pToken=0x2fdae8) returned 0x0 [0122.302] WbemLocator:IUnknown:Release (This=0x6a696c) returned 0x1 [0122.302] IUnknown:Release (This=0x711caf4) returned 0x0 [0122.304] CoGetContextToken (in: pToken=0x2fdb1c | out: pToken=0x2fdb1c) returned 0x0 [0122.304] CoGetContextToken (in: pToken=0x2fdae8 | out: pToken=0x2fdae8) returned 0x0 [0122.304] WbemLocator:IUnknown:Release (This=0x6c3ee4) returned 0x1 [0122.304] IUnknown:Release (This=0x712a20c) returned 0x0 [0122.306] CoGetContextToken (in: pToken=0x2fdb1c | out: pToken=0x2fdb1c) returned 0x0 [0122.306] CoGetContextToken (in: pToken=0x2fdae8 | out: pToken=0x2fdae8) returned 0x0 [0122.306] WbemLocator:IUnknown:Release (This=0x6ac39c) returned 0x1 [0122.306] IUnknown:Release (This=0x712296c) returned 0x0 [0122.307] CoGetContextToken (in: pToken=0x2fdb1c | out: pToken=0x2fdb1c) returned 0x0 [0122.307] CoGetContextToken (in: pToken=0x2fdae8 | out: pToken=0x2fdae8) returned 0x0 [0122.307] WbemLocator:IUnknown:Release (This=0x6aa8ac) returned 0x1 [0122.307] IUnknown:Release (This=0x711cbbc) returned 0x0 Thread: id = 179 os_tid = 0x7f8 Thread: id = 180 os_tid = 0x78c [0087.527] CoGetContextToken (in: pToken=0xddf958 | out: pToken=0xddf958) returned 0x800401f0 [0087.527] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0121.123] CoGetContextToken (in: pToken=0xddf938 | out: pToken=0xddf938) returned 0x0 [0121.123] CoGetContextToken (in: pToken=0xddf8c8 | out: pToken=0xddf8c8) returned 0x0 [0121.123] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x0 [0121.123] CoGetContextToken (in: pToken=0xddf8c8 | out: pToken=0xddf8c8) returned 0x0 [0121.123] WbemLocator:IUnknown:Release (This=0x7110ae0) returned 0x0 [0121.123] CoGetContextToken (in: pToken=0xddf8c8 | out: pToken=0xddf8c8) returned 0x0 [0121.123] WbemLocator:IUnknown:Release (This=0x7125dd0) returned 0x0 [0121.123] CoGetContextToken (in: pToken=0xddf8c8 | out: pToken=0xddf8c8) returned 0x0 [0121.123] WbemLocator:IUnknown:Release (This=0x7125ac8) returned 0x0 [0121.124] CoGetContextToken (in: pToken=0xddf938 | out: pToken=0xddf938) returned 0x0 [0121.124] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x6267beb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xddf90c | out: ppvObject=0xddf90c*=0x6484d0) returned 0x0 [0121.124] CObjectContext::ContextCallback () returned 0x0 [0122.301] IUnknown:Release (This=0x6484d0) returned 0x1 [0122.302] CoGetContextToken (in: pToken=0xddf894 | out: pToken=0xddf894) returned 0x0 [0122.302] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x6267beb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xddf868 | out: ppvObject=0xddf868*=0x6484d0) returned 0x0 [0122.302] CObjectContext::ContextCallback () returned 0x0 [0122.303] IUnknown:Release (This=0x6484d0) returned 0x1 [0122.303] CoGetContextToken (in: pToken=0xddf894 | out: pToken=0xddf894) returned 0x0 [0122.303] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x6267beb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xddf868 | out: ppvObject=0xddf868*=0x6484d0) returned 0x0 [0122.304] CObjectContext::ContextCallback () returned 0x0 [0122.305] IUnknown:Release (This=0x6484d0) returned 0x1 [0122.305] IUnknown:Release (This=0x711f230) returned 0x0 [0122.305] CoGetContextToken (in: pToken=0xddf894 | out: pToken=0xddf894) returned 0x0 [0122.305] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x6267beb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xddf868 | out: ppvObject=0xddf868*=0x6484d0) returned 0x0 [0122.306] CObjectContext::ContextCallback () returned 0x0 [0122.307] IUnknown:Release (This=0x6484d0) returned 0x1 [0122.307] IUnknown:Release (This=0x711cbf8) returned 0x0 [0122.307] CoGetContextToken (in: pToken=0xddf894 | out: pToken=0xddf894) returned 0x0 [0122.307] IUnknown:QueryInterface (in: This=0x6484c0, riid=0x6267beb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xddf868 | out: ppvObject=0xddf868*=0x6484d0) returned 0x0 [0122.307] CObjectContext::ContextCallback () returned 0x0 [0122.308] IUnknown:Release (This=0x6484d0) returned 0x1 [0122.308] IUnknown:Release (This=0x6484c0) returned 0x0 [0122.309] CloseHandle (hObject=0x1b4) returned 1 [0122.309] GetLastError () returned 0x0 [0122.309] CloseHandle (hObject=0x694) returned 1 [0122.309] GetLastError () returned 0x0 [0122.309] CertFreeCRLContext (pCrlContext=0x8ea3aa8) returned 1 [0122.309] GetLastError () returned 0x0 [0122.310] CloseHandle (hObject=0x3f4) returned 1 [0122.310] GetLastError () returned 0x0 [0122.310] CloseHandle (hObject=0x680) returned 1 [0122.310] GetLastError () returned 0x0 [0122.310] CloseHandle (hObject=0x67c) returned 1 [0122.310] GetLastError () returned 0x0 [0122.310] LocalFree (hMem=0x6a6d78) returned 0x0 [0122.310] GetLastError () returned 0x0 [0122.311] CloseHandle (hObject=0x5ec) returned 1 [0122.311] GetLastError () returned 0x0 [0122.311] LocalFree (hMem=0x6a6d68) returned 0x0 [0122.311] GetLastError () returned 0x0 [0122.311] LocalFree (hMem=0x6a6d28) returned 0x0 [0122.311] GetLastError () returned 0x0 [0122.311] LocalFree (hMem=0x6a6d48) returned 0x0 [0122.311] GetLastError () returned 0x0 [0122.311] CloseHandle (hObject=0x5e8) returned 1 [0122.311] GetLastError () returned 0x0 [0122.311] CloseHandle (hObject=0x3c8) returned 1 [0122.312] GetLastError () returned 0x0 [0122.312] CertFreeCRLContext (pCrlContext=0x6e03c8) returned 1 [0122.312] GetLastError () returned 0x0 [0122.312] CloseHandle (hObject=0x5e4) returned 1 [0122.312] GetLastError () returned 0x0 [0122.312] CloseHandle (hObject=0x3ac) returned 1 [0122.312] GetLastError () returned 0x0 [0122.312] CloseHandle (hObject=0x3a8) returned 1 [0122.312] GetLastError () returned 0x0 [0122.313] CloseHandle (hObject=0x338) returned 1 [0122.313] GetLastError () returned 0x0 [0122.313] CloseHandle (hObject=0x5e0) returned 1 [0122.313] GetLastError () returned 0x0 [0122.313] CloseHandle (hObject=0x5dc) returned 1 [0122.313] GetLastError () returned 0x0 [0122.313] CloseHandle (hObject=0x2c8) returned 1 [0122.313] GetLastError () returned 0x0 [0122.313] CloseHandle (hObject=0x270) returned 1 [0122.313] GetLastError () returned 0x0 [0122.314] CertFreeCRLContext (pCrlContext=0x8ea3af8) returned 1 [0122.314] GetLastError () returned 0x0 [0122.314] CloseHandle (hObject=0x6c0) returned 1 [0122.314] GetLastError () returned 0x0 [0122.315] CloseHandle (hObject=0x690) returned 1 [0122.315] GetLastError () returned 0x0 [0122.316] CloseHandle (hObject=0x574) returned 1 [0122.316] GetLastError () returned 0x0 [0122.316] CloseHandle (hObject=0x3b8) returned 1 [0122.316] GetLastError () returned 0x0 [0122.316] CloseHandle (hObject=0x26c) returned 1 [0122.316] GetLastError () returned 0x0 [0122.316] CertCloseStore (hCertStore=0x65e918, dwFlags=0x0) returned 1 [0122.316] GetLastError () returned 0x0 [0122.317] CloseHandle (hObject=0x268) returned 1 [0122.317] GetLastError () returned 0x0 [0122.317] CloseHandle (hObject=0x264) returned 1 [0122.317] GetLastError () returned 0x0 [0122.317] CloseHandle (hObject=0x260) returned 1 [0122.317] GetLastError () returned 0x0 [0122.317] CloseHandle (hObject=0x4ac) returned 1 [0122.317] GetLastError () returned 0x0 [0122.318] CloseHandle (hObject=0x25c) returned 1 [0122.318] GetLastError () returned 0x0 [0122.318] CertFreeCRLContext (pCrlContext=0x6e03c8) returned 1 [0122.318] GetLastError () returned 0x0 [0122.318] CloseHandle (hObject=0x254) returned 1 [0122.318] GetLastError () returned 0x0 [0122.318] CloseHandle (hObject=0x258) returned 1 [0122.318] GetLastError () returned 0x0 [0122.318] CertFreeCRLContext (pCrlContext=0x6e0418) returned 1 [0122.318] GetLastError () returned 0x0 [0122.319] CloseHandle (hObject=0x250) returned 1 [0122.319] GetLastError () returned 0x0 [0141.210] IUnknown:Release (This=0x7125c48) returned 0x0 [0141.210] IUnknown:Release (This=0x711f628) returned 0x0 [0141.213] IUnknown:Release (This=0x711cd98) returned 0x0 [0141.213] IUnknown:Release (This=0x7125e00) returned 0x0 [0141.213] IUnknown:Release (This=0x711cc00) returned 0x0 [0141.214] IUnknown:Release (This=0x711cf30) returned 0x0 [0141.214] IUnknown:Release (This=0x711ca68) returned 0x0 [0141.214] IUnknown:Release (This=0x711f7c0) returned 0x0 [0141.214] IUnknown:Release (This=0x7129e18) returned 0x0 Thread: id = 181 os_tid = 0x7cc [0090.035] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 182 os_tid = 0x958 [0090.202] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 183 os_tid = 0x95c Thread: id = 184 os_tid = 0x978 Thread: id = 185 os_tid = 0x980 Thread: id = 186 os_tid = 0x984 Thread: id = 187 os_tid = 0x990 [0091.425] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0091.455] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x729efc4 | out: lpiid=0x729efc4) returned 0x0 [0091.456] CoGetClassObject (in: rclsid=0x689aa4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6254a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x729ef2c | out: ppv=0x729ef2c*=0x7110810) returned 0x0 [0091.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110810, riid=0x62637ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x729ed5c | out: ppvObject=0x729ed5c*=0x0) returned 0x80004002 [0091.478] WbemDefPath:IClassFactory:CreateInstance (in: This=0x7110810, pUnkOuter=0x0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729ed94 | out: ppvObject=0x729ed94*=0x7110820) returned 0x0 [0091.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110820, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729eb38 | out: ppvObject=0x729eb38*=0x7110820) returned 0x0 [0091.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110820, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x729eaf4 | out: ppvObject=0x729eaf4*=0x0) returned 0x80004002 [0091.479] WbemDefPath:IUnknown:AddRef (This=0x7110820) returned 0x3 [0091.479] CoGetContextToken (in: pToken=0x729e980 | out: pToken=0x729e980) returned 0x0 [0091.479] CoGetObjectContext (in: riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x67ce7c | out: ppv=0x67ce7c*=0x648630) returned 0x0 [0091.480] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110820, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729e968 | out: ppvObject=0x729e968*=0x6778d0) returned 0x0 [0091.480] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6778d0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x729e970 | out: pCid=0x729e970*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0091.480] WbemDefPath:IUnknown:Release (This=0x6778d0) returned 0x3 [0091.480] CoGetContextToken (in: pToken=0x729e978 | out: pToken=0x729e978) returned 0x0 [0091.480] WbemDefPath:IUnknown:AddRef (This=0x7110820) returned 0x4 [0091.480] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110820, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729e9ec | out: ppvObject=0x729e9ec*=0x0) returned 0x80004002 [0091.480] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x3 [0091.481] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x2 [0091.481] WbemDefPath:IUnknown:Release (This=0x7110810) returned 0x0 [0091.481] WbemDefPath:IUnknown:Release (This=0x7110820) returned 0x1 [0091.481] SetEvent (hEvent=0x270) returned 1 [0091.481] GetLastError () returned 0x0 [0091.483] CoGetClassObject (in: rclsid=0x689aa4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6254a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x729ef2c | out: ppv=0x729ef2c*=0x7110810) returned 0x0 [0091.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110810, riid=0x62637ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x729ed5c | out: ppvObject=0x729ed5c*=0x0) returned 0x80004002 [0091.483] WbemDefPath:IClassFactory:CreateInstance (in: This=0x7110810, pUnkOuter=0x0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729ed94 | out: ppvObject=0x729ed94*=0x71108b8) returned 0x0 [0091.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729eb38 | out: ppvObject=0x729eb38*=0x71108b8) returned 0x0 [0091.484] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x729eaf4 | out: ppvObject=0x729eaf4*=0x0) returned 0x80004002 [0091.484] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0091.484] CoGetContextToken (in: pToken=0x729e980 | out: pToken=0x729e980) returned 0x0 [0091.484] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729e968 | out: ppvObject=0x729e968*=0x677910) returned 0x0 [0091.484] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x677910, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x729e970 | out: pCid=0x729e970*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0091.484] WbemDefPath:IUnknown:Release (This=0x677910) returned 0x3 [0091.484] CoGetContextToken (in: pToken=0x729e978 | out: pToken=0x729e978) returned 0x0 [0091.484] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x4 [0091.484] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729e9ec | out: ppvObject=0x729e9ec*=0x0) returned 0x80004002 [0091.484] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x3 [0091.484] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.484] WbemDefPath:IUnknown:Release (This=0x7110810) returned 0x0 [0091.484] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x1 [0091.485] SetEvent (hEvent=0x2c8) returned 1 [0091.485] GetLastError () returned 0x36b7 [0092.294] CoGetClassObject (in: rclsid=0x689aa4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6254a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x729ef2c | out: ppv=0x729ef2c*=0x7110bb0) returned 0x0 [0092.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110bb0, riid=0x62637ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x729ed5c | out: ppvObject=0x729ed5c*=0x0) returned 0x80004002 [0092.294] WbemDefPath:IClassFactory:CreateInstance (in: This=0x7110bb0, pUnkOuter=0x0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729ed94 | out: ppvObject=0x729ed94*=0x71259c8) returned 0x0 [0092.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x71259c8, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729eb38 | out: ppvObject=0x729eb38*=0x71259c8) returned 0x0 [0092.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x71259c8, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x729eaf4 | out: ppvObject=0x729eaf4*=0x0) returned 0x80004002 [0092.295] WbemDefPath:IUnknown:AddRef (This=0x71259c8) returned 0x3 [0092.295] CoGetContextToken (in: pToken=0x729e980 | out: pToken=0x729e980) returned 0x0 [0092.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x71259c8, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729e968 | out: ppvObject=0x729e968*=0x6a6a78) returned 0x0 [0092.295] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6a6a78, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x729e970 | out: pCid=0x729e970*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0092.295] WbemDefPath:IUnknown:Release (This=0x6a6a78) returned 0x3 [0092.295] CoGetContextToken (in: pToken=0x729e978 | out: pToken=0x729e978) returned 0x0 [0092.295] WbemDefPath:IUnknown:AddRef (This=0x71259c8) returned 0x4 [0092.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x71259c8, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729e9ec | out: ppvObject=0x729e9ec*=0x0) returned 0x80004002 [0092.295] WbemDefPath:IUnknown:Release (This=0x71259c8) returned 0x3 [0092.295] WbemDefPath:IUnknown:Release (This=0x71259c8) returned 0x2 [0092.295] WbemDefPath:IUnknown:Release (This=0x7110bb0) returned 0x0 [0092.296] WbemDefPath:IUnknown:Release (This=0x71259c8) returned 0x1 [0092.296] SetEvent (hEvent=0x338) returned 1 [0092.296] GetLastError () returned 0x36b7 [0096.889] CoGetClassObject (in: rclsid=0x689aa4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6254a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x729ef2c | out: ppv=0x729ef2c*=0x711fa48) returned 0x0 [0096.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x711fa48, riid=0x62637ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x729ed5c | out: ppvObject=0x729ed5c*=0x0) returned 0x80004002 [0096.889] WbemDefPath:IClassFactory:CreateInstance (in: This=0x711fa48, pUnkOuter=0x0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729ed94 | out: ppvObject=0x729ed94*=0x711f560) returned 0x0 [0096.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x711f560, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729eb38 | out: ppvObject=0x729eb38*=0x711f560) returned 0x0 [0096.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x711f560, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x729eaf4 | out: ppvObject=0x729eaf4*=0x0) returned 0x80004002 [0096.890] WbemDefPath:IUnknown:AddRef (This=0x711f560) returned 0x3 [0096.890] CoGetContextToken (in: pToken=0x729e980 | out: pToken=0x729e980) returned 0x0 [0096.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x711f560, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729e968 | out: ppvObject=0x729e968*=0x6d7698) returned 0x0 [0096.890] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d7698, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x729e970 | out: pCid=0x729e970*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0096.890] WbemDefPath:IUnknown:Release (This=0x6d7698) returned 0x3 [0096.890] CoGetContextToken (in: pToken=0x729e978 | out: pToken=0x729e978) returned 0x0 [0096.890] WbemDefPath:IUnknown:AddRef (This=0x711f560) returned 0x4 [0096.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x711f560, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729e9ec | out: ppvObject=0x729e9ec*=0x0) returned 0x80004002 [0096.890] WbemDefPath:IUnknown:Release (This=0x711f560) returned 0x3 [0096.890] WbemDefPath:IUnknown:Release (This=0x711f560) returned 0x2 [0096.890] WbemDefPath:IUnknown:Release (This=0x711fa48) returned 0x0 [0096.890] WbemDefPath:IUnknown:Release (This=0x711f560) returned 0x1 [0096.890] SetEvent (hEvent=0x3f4) returned 1 [0096.890] GetLastError () returned 0x36b7 [0100.578] CoGetClassObject (in: rclsid=0x689aa4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6254a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x729ef2c | out: ppv=0x729ef2c*=0x711fa48) returned 0x0 [0100.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x711fa48, riid=0x62637ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x729ed5c | out: ppvObject=0x729ed5c*=0x0) returned 0x80004002 [0100.579] WbemDefPath:IClassFactory:CreateInstance (in: This=0x711fa48, pUnkOuter=0x0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729ed94 | out: ppvObject=0x729ed94*=0x7131b58) returned 0x0 [0100.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729eb38 | out: ppvObject=0x729eb38*=0x7131b58) returned 0x0 [0100.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x729eaf4 | out: ppvObject=0x729eaf4*=0x0) returned 0x80004002 [0100.579] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x3 [0100.579] CoGetContextToken (in: pToken=0x729e980 | out: pToken=0x729e980) returned 0x0 [0100.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729e968 | out: ppvObject=0x729e968*=0x6d77c8) returned 0x0 [0100.579] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d77c8, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x729e970 | out: pCid=0x729e970*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0100.579] WbemDefPath:IUnknown:Release (This=0x6d77c8) returned 0x3 [0100.579] CoGetContextToken (in: pToken=0x729e978 | out: pToken=0x729e978) returned 0x0 [0100.579] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x4 [0100.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x729e9ec | out: ppvObject=0x729e9ec*=0x0) returned 0x80004002 [0100.580] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x3 [0100.580] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.580] WbemDefPath:IUnknown:Release (This=0x711fa48) returned 0x0 [0100.580] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x1 [0100.580] SetEvent (hEvent=0x4ac) returned 1 [0100.585] GetLastError () returned 0x36b7 Thread: id = 188 os_tid = 0x5e4 [0091.499] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0091.503] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x741f4c0 | out: lpiid=0x741f4c0) returned 0x0 [0091.503] CoGetClassObject (in: rclsid=0x696464*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6254a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x741f428 | out: ppv=0x741f428*=0x7110978) returned 0x0 [0091.524] WbemLocator:IUnknown:QueryInterface (in: This=0x7110978, riid=0x62637ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x741f258 | out: ppvObject=0x741f258*=0x0) returned 0x80004002 [0091.524] WbemLocator:IClassFactory:CreateInstance (in: This=0x7110978, pUnkOuter=0x0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x741f290 | out: ppvObject=0x741f290*=0x7110ae0) returned 0x0 [0091.525] WbemLocator:IUnknown:QueryInterface (in: This=0x7110ae0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x741f034 | out: ppvObject=0x741f034*=0x7110ae0) returned 0x0 [0091.525] WbemLocator:IUnknown:QueryInterface (in: This=0x7110ae0, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x741eff0 | out: ppvObject=0x741eff0*=0x0) returned 0x80004002 [0091.525] WbemLocator:IUnknown:AddRef (This=0x7110ae0) returned 0x3 [0091.525] CoGetContextToken (in: pToken=0x741ee7c | out: pToken=0x741ee7c) returned 0x0 [0091.525] WbemLocator:IUnknown:QueryInterface (in: This=0x7110ae0, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x741ee64 | out: ppvObject=0x741ee64*=0x0) returned 0x80004002 [0091.525] CoGetContextToken (in: pToken=0x741ee74 | out: pToken=0x741ee74) returned 0x0 [0091.525] WbemLocator:IUnknown:AddRef (This=0x7110ae0) returned 0x4 [0091.525] WbemLocator:IUnknown:QueryInterface (in: This=0x7110ae0, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x741eee8 | out: ppvObject=0x741eee8*=0x0) returned 0x80004002 [0091.525] WbemLocator:IUnknown:Release (This=0x7110ae0) returned 0x3 [0091.525] WbemLocator:IUnknown:Release (This=0x7110ae0) returned 0x2 [0091.525] WbemLocator:IUnknown:Release (This=0x7110978) returned 0x0 [0091.526] WbemLocator:IUnknown:Release (This=0x7110ae0) returned 0x1 [0091.526] CoGetContextToken (in: pToken=0x741f380 | out: pToken=0x741f380) returned 0x0 [0091.526] CoGetContextToken (in: pToken=0x741f340 | out: pToken=0x741f340) returned 0x0 [0091.526] WbemLocator:IUnknown:AddRef (This=0x7110ae0) returned 0x2 [0091.526] WbemLocator:IUnknown:QueryInterface (in: This=0x7110ae0, riid=0x741f3bc*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x741f3b8 | out: ppvObject=0x741f3b8*=0x7110ae0) returned 0x0 [0091.526] WbemLocator:IUnknown:Release (This=0x7110ae0) returned 0x2 [0091.526] WbemLocator:IUnknown:Release (This=0x7110ae0) returned 0x1 [0091.534] CoGetContextToken (in: pToken=0x741f3fc | out: pToken=0x741f3fc) returned 0x0 [0091.534] CoGetContextToken (in: pToken=0x741f3bc | out: pToken=0x741f3bc) returned 0x0 [0091.534] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x2 [0091.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x71108b8, riid=0x741f438*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x741f434 | out: ppvObject=0x741f434*=0x71108b8) returned 0x0 [0091.534] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.534] WbemDefPath:IUnknown:AddRef (This=0x71108b8) returned 0x3 [0091.535] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x71108b8, puCount=0x741f5b0 | out: puCount=0x741f5b0*=0x2) returned 0x0 [0091.535] WbemDefPath:IUnknown:Release (This=0x71108b8) returned 0x2 [0091.535] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=8, puBuffLength=0x741f5ac*=0x0, pszText=0x0 | out: puBuffLength=0x741f5ac*=0xf, pszText=0x0) returned 0x0 [0091.535] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=8, puBuffLength=0x741f5ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x741f5ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0091.540] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x741e758, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0091.540] GetLastError () returned 0x0 [0091.542] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\\\wminet_utils.dll") returned 0x6a310000 [0091.643] GetProcAddress (hModule=0x6a310000, lpProcName="ResetSecurity") returned 0x6a311944 [0091.647] GetProcAddress (hModule=0x6a310000, lpProcName="SetSecurity") returned 0x6a311986 [0091.649] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServices") returned 0x6a3119cc [0091.651] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServicesObject") returned 0x6a311a1e [0091.655] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyHandle") returned 0x6a311a70 [0091.657] GetProcAddress (hModule=0x6a310000, lpProcName="WritePropertyValue") returned 0x6a311a89 [0091.659] GetProcAddress (hModule=0x6a310000, lpProcName="Clone") returned 0x6a311aa2 [0091.662] GetProcAddress (hModule=0x6a310000, lpProcName="VerifyClientKey") returned 0x6a312270 [0091.664] GetProcAddress (hModule=0x6a310000, lpProcName="GetQualifierSet") returned 0x6a311d73 [0091.666] GetProcAddress (hModule=0x6a310000, lpProcName="Get") returned 0x6a311b96 [0091.669] GetProcAddress (hModule=0x6a310000, lpProcName="Put") returned 0x6a311b7a [0091.671] GetProcAddress (hModule=0x6a310000, lpProcName="Delete") returned 0x6a311bb5 [0091.673] GetProcAddress (hModule=0x6a310000, lpProcName="GetNames") returned 0x6a311bc8 [0091.678] GetProcAddress (hModule=0x6a310000, lpProcName="BeginEnumeration") returned 0x6a311be4 [0091.681] GetProcAddress (hModule=0x6a310000, lpProcName="Next") returned 0x6a311bf7 [0091.683] GetProcAddress (hModule=0x6a310000, lpProcName="EndEnumeration") returned 0x6a311c16 [0091.685] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyQualifierSet") returned 0x6a311c26 [0091.687] GetProcAddress (hModule=0x6a310000, lpProcName="Clone") returned 0x6a311aa2 [0091.687] GetProcAddress (hModule=0x6a310000, lpProcName="GetObjectText") returned 0x6a311c3c [0091.689] GetProcAddress (hModule=0x6a310000, lpProcName="SpawnDerivedClass") returned 0x6a311c52 [0091.692] GetProcAddress (hModule=0x6a310000, lpProcName="SpawnInstance") returned 0x6a311c68 [0091.694] GetProcAddress (hModule=0x6a310000, lpProcName="CompareTo") returned 0x6a311c7e [0091.696] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyOrigin") returned 0x6a311c94 [0091.698] GetProcAddress (hModule=0x6a310000, lpProcName="InheritsFrom") returned 0x6a311caa [0091.700] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethod") returned 0x6a311cbd [0091.703] GetProcAddress (hModule=0x6a310000, lpProcName="PutMethod") returned 0x6a311cd9 [0091.705] GetProcAddress (hModule=0x6a310000, lpProcName="DeleteMethod") returned 0x6a311cf5 [0091.708] GetProcAddress (hModule=0x6a310000, lpProcName="BeginMethodEnumeration") returned 0x6a311d08 [0091.710] GetProcAddress (hModule=0x6a310000, lpProcName="NextMethod") returned 0x6a311d1b [0091.712] GetProcAddress (hModule=0x6a310000, lpProcName="EndMethodEnumeration") returned 0x6a311d37 [0091.714] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethodQualifierSet") returned 0x6a311d47 [0091.716] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethodOrigin") returned 0x6a311d5d [0091.718] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Get") returned 0x6a311d86 [0091.720] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Put") returned 0x6a311da2 [0091.724] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Delete") returned 0x6a311dbb [0091.726] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_GetNames") returned 0x6a311dce [0091.728] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6a311de4 [0091.730] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Next") returned 0x6a311df7 [0091.732] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_EndEnumeration") returned 0x6a311e13 [0091.734] GetProcAddress (hModule=0x6a310000, lpProcName="GetCurrentApartmentType") returned 0x6a311d73 [0091.736] GetProcAddress (hModule=0x6a310000, lpProcName="GetDemultiplexedStub") returned 0x6a3118fd [0091.739] GetProcAddress (hModule=0x6a310000, lpProcName="CreateInstanceEnumWmi") returned 0x6a311580 [0091.742] GetProcAddress (hModule=0x6a310000, lpProcName="CreateClassEnumWmi") returned 0x6a3115f6 [0091.744] GetProcAddress (hModule=0x6a310000, lpProcName="ExecQueryWmi") returned 0x6a31169e [0091.746] GetProcAddress (hModule=0x6a310000, lpProcName="ExecNotificationQueryWmi") returned 0x6a311717 [0091.749] GetProcAddress (hModule=0x6a310000, lpProcName="PutInstanceWmi") returned 0x6a311790 [0091.751] GetProcAddress (hModule=0x6a310000, lpProcName="PutClassWmi") returned 0x6a311810 [0091.754] GetProcAddress (hModule=0x6a310000, lpProcName="CloneEnumWbemClassObject") returned 0x6a311890 [0091.756] GetProcAddress (hModule=0x6a310000, lpProcName="ConnectServerWmi") returned 0x6a3124b7 [0091.759] CoCreateInstance (in: rclsid=0x6a3113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a3112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x741f088 | out: ppv=0x741f088*=0x7110978) returned 0x0 [0091.759] WbemLocator:IWbemLocator:ConnectServer (in: This=0x7110978, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x741f0d4 | out: ppNamespace=0x741f0d4*=0x711ca54) returned 0x0 [0091.798] WbemLocator:IUnknown:QueryInterface (in: This=0x711ca54, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x741efa4 | out: ppvObject=0x741efa4*=0x6a3504) returned 0x0 [0091.798] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6a3504, pProxy=0x711ca54, pAuthnSvc=0x741efec, pAuthzSvc=0x741efe8, pServerPrincName=0x741eff8, pAuthnLevel=0x741eff0, pImpLevel=0x741efdc, pAuthInfo=0x741efe0, pCapabilites=0x741efe4 | out: pAuthnSvc=0x741efec*=0xa, pAuthzSvc=0x741efe8*=0x0, pServerPrincName=0x741eff8, pAuthnLevel=0x741eff0*=0x6, pImpLevel=0x741efdc*=0x2, pAuthInfo=0x741efe0, pCapabilites=0x741efe4*=0x1) returned 0x0 [0091.798] WbemLocator:IUnknown:Release (This=0x6a3504) returned 0x1 [0091.798] WbemLocator:IUnknown:QueryInterface (in: This=0x711ca54, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x741ef98 | out: ppvObject=0x741ef98*=0x6a3524) returned 0x0 [0091.798] WbemLocator:IUnknown:QueryInterface (in: This=0x711ca54, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x741ef94 | out: ppvObject=0x741ef94*=0x6a3504) returned 0x0 [0091.798] WbemLocator:IClientSecurity:SetBlanket (This=0x6a3504, pProxy=0x711ca54, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0091.798] WbemLocator:IUnknown:Release (This=0x6a3504) returned 0x2 [0091.798] WbemLocator:IUnknown:Release (This=0x6a3524) returned 0x1 [0091.798] CoTaskMemFree (pv=0x67cf00) [0091.799] WbemLocator:IUnknown:Release (This=0x7110978) returned 0x0 [0091.799] WbemLocator:IUnknown:QueryInterface (in: This=0x711ca54, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x741e954 | out: ppvObject=0x741e954*=0x6a3524) returned 0x0 [0091.799] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3524, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x741e910 | out: ppvObject=0x741e910*=0x0) returned 0x80004002 [0091.799] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3524, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x741e804 | out: ppvObject=0x741e804*=0x0) returned 0x80004002 [0091.799] WbemLocator:IUnknown:AddRef (This=0x6a3524) returned 0x3 [0091.799] CoGetContextToken (in: pToken=0x741e79c | out: pToken=0x741e79c) returned 0x0 [0091.799] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3524, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x741e784 | out: ppvObject=0x741e784*=0x6a3484) returned 0x0 [0091.799] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6a3484, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x741e78c | out: pCid=0x741e78c*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0091.800] WbemLocator:IUnknown:Release (This=0x6a3484) returned 0x3 [0091.800] CoGetContextToken (in: pToken=0x741e794 | out: pToken=0x741e794) returned 0x0 [0091.800] WbemLocator:IUnknown:AddRef (This=0x6a3524) returned 0x4 [0091.800] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3524, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x741e808 | out: ppvObject=0x741e808*=0x6a350c) returned 0x0 [0091.800] WbemLocator:IUnknown:Release (This=0x6a3524) returned 0x4 [0091.800] WbemLocator:IRpcOptions:Query (in: This=0x6a350c, pPrx=0x6a3524, dwProperty=2, pdwValue=0x741e82c | out: pdwValue=0x741e82c) returned 0x80004002 [0091.800] WbemLocator:IUnknown:Release (This=0x6a350c) returned 0x3 [0091.800] WbemLocator:IUnknown:Release (This=0x6a3524) returned 0x2 [0091.801] CoGetContextToken (in: pToken=0x741ec08 | out: pToken=0x741ec08) returned 0x0 [0091.801] CoGetContextToken (in: pToken=0x741ebc8 | out: pToken=0x741ebc8) returned 0x0 [0091.801] WbemLocator:IUnknown:AddRef (This=0x6a3524) returned 0x3 [0091.801] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3524, riid=0x741ec44*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x741ec40 | out: ppvObject=0x741ec40*=0x711ca54) returned 0x0 [0091.801] WbemLocator:IUnknown:Release (This=0x6a3524) returned 0x3 [0091.801] WbemLocator:IUnknown:Release (This=0x711ca54) returned 0x2 [0091.801] WbemLocator:IUnknown:Release (This=0x711ca54) returned 0x1 [0091.802] CoUninitialize () Thread: id = 189 os_tid = 0x900 Thread: id = 190 os_tid = 0x9a0 [0091.814] CoGetContextToken (in: pToken=0x739f624 | out: pToken=0x739f624) returned 0x0 [0091.814] CoGetContextToken (in: pToken=0x739f614 | out: pToken=0x739f614) returned 0x0 [0091.814] CoGetMarshalSizeMax (in: pulSize=0x739f5e0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x6a3524, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x739f5e0) returned 0x0 [0091.815] CoMarshalInterface (pStm=0x6969d8, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x6a3524, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0096.787] CoGetContextToken (in: pToken=0x739f624 | out: pToken=0x739f624) returned 0x0 [0096.787] CoGetContextToken (in: pToken=0x739f614 | out: pToken=0x739f614) returned 0x0 [0096.787] CoGetMarshalSizeMax (in: pulSize=0x739f5e0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x6c3df4, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x739f5e0) returned 0x0 [0096.787] CoMarshalInterface (pStm=0x6d1160, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x6c3df4, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 219 os_tid = 0xa48 [0096.751] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0096.754] CoGetClassObject (in: rclsid=0x696464*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6254a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x74af248 | out: ppv=0x74af248*=0x7126930) returned 0x0 [0096.755] WbemLocator:IUnknown:QueryInterface (in: This=0x7126930, riid=0x62637ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x74af078 | out: ppvObject=0x74af078*=0x0) returned 0x80004002 [0096.755] WbemLocator:IClassFactory:CreateInstance (in: This=0x7126930, pUnkOuter=0x0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x74af0b0 | out: ppvObject=0x74af0b0*=0x7125dd0) returned 0x0 [0096.755] WbemLocator:IUnknown:QueryInterface (in: This=0x7125dd0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x74aee54 | out: ppvObject=0x74aee54*=0x7125dd0) returned 0x0 [0096.755] WbemLocator:IUnknown:QueryInterface (in: This=0x7125dd0, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x74aee10 | out: ppvObject=0x74aee10*=0x0) returned 0x80004002 [0096.755] WbemLocator:IUnknown:AddRef (This=0x7125dd0) returned 0x3 [0096.755] CoGetContextToken (in: pToken=0x74aec9c | out: pToken=0x74aec9c) returned 0x0 [0096.755] WbemLocator:IUnknown:QueryInterface (in: This=0x7125dd0, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x74aec84 | out: ppvObject=0x74aec84*=0x0) returned 0x80004002 [0096.756] CoGetContextToken (in: pToken=0x74aec94 | out: pToken=0x74aec94) returned 0x0 [0096.756] WbemLocator:IUnknown:AddRef (This=0x7125dd0) returned 0x4 [0096.756] WbemLocator:IUnknown:QueryInterface (in: This=0x7125dd0, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x74aed08 | out: ppvObject=0x74aed08*=0x0) returned 0x80004002 [0096.756] WbemLocator:IUnknown:Release (This=0x7125dd0) returned 0x3 [0096.756] WbemLocator:IUnknown:Release (This=0x7125dd0) returned 0x2 [0096.756] WbemLocator:IUnknown:Release (This=0x7126930) returned 0x0 [0096.756] WbemLocator:IUnknown:Release (This=0x7125dd0) returned 0x1 [0096.756] CoGetContextToken (in: pToken=0x74af1a0 | out: pToken=0x74af1a0) returned 0x0 [0096.756] CoGetContextToken (in: pToken=0x74af160 | out: pToken=0x74af160) returned 0x0 [0096.756] WbemLocator:IUnknown:AddRef (This=0x7125dd0) returned 0x2 [0096.756] WbemLocator:IUnknown:QueryInterface (in: This=0x7125dd0, riid=0x74af1dc*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x74af1d8 | out: ppvObject=0x74af1d8*=0x7125dd0) returned 0x0 [0096.756] WbemLocator:IUnknown:Release (This=0x7125dd0) returned 0x2 [0096.756] WbemLocator:IUnknown:Release (This=0x7125dd0) returned 0x1 [0096.756] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x71108b8, puCount=0x74af3d0 | out: puCount=0x74af3d0*=0x2) returned 0x0 [0096.756] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=8, puBuffLength=0x74af3cc*=0x0, pszText=0x0 | out: puBuffLength=0x74af3cc*=0xf, pszText=0x0) returned 0x0 [0096.756] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=8, puBuffLength=0x74af3cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x74af3cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0096.756] CoCreateInstance (in: rclsid=0x6a3113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a3112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x74aeea8 | out: ppv=0x74aeea8*=0x711fa48) returned 0x0 [0096.756] WbemLocator:IWbemLocator:ConnectServer (in: This=0x711fa48, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x74aeef4 | out: ppNamespace=0x74aeef4*=0x7129e04) returned 0x0 [0096.770] WbemLocator:IUnknown:QueryInterface (in: This=0x7129e04, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x74aedc4 | out: ppvObject=0x74aedc4*=0x6c3dd4) returned 0x0 [0096.770] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c3dd4, pProxy=0x7129e04, pAuthnSvc=0x74aee0c, pAuthzSvc=0x74aee08, pServerPrincName=0x74aee18, pAuthnLevel=0x74aee10, pImpLevel=0x74aedfc, pAuthInfo=0x74aee00, pCapabilites=0x74aee04 | out: pAuthnSvc=0x74aee0c*=0xa, pAuthzSvc=0x74aee08*=0x0, pServerPrincName=0x74aee18, pAuthnLevel=0x74aee10*=0x6, pImpLevel=0x74aedfc*=0x2, pAuthInfo=0x74aee00, pCapabilites=0x74aee04*=0x1) returned 0x0 [0096.770] WbemLocator:IUnknown:Release (This=0x6c3dd4) returned 0x1 [0096.771] WbemLocator:IUnknown:QueryInterface (in: This=0x7129e04, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x74aedb8 | out: ppvObject=0x74aedb8*=0x6c3df4) returned 0x0 [0096.771] WbemLocator:IUnknown:QueryInterface (in: This=0x7129e04, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x74aedb4 | out: ppvObject=0x74aedb4*=0x6c3dd4) returned 0x0 [0096.771] WbemLocator:IClientSecurity:SetBlanket (This=0x6c3dd4, pProxy=0x7129e04, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0096.771] WbemLocator:IUnknown:Release (This=0x6c3dd4) returned 0x2 [0096.771] WbemLocator:IUnknown:Release (This=0x6c3df4) returned 0x1 [0096.771] CoTaskMemFree (pv=0x6c0098) [0096.771] WbemLocator:IUnknown:Release (This=0x711fa48) returned 0x0 [0096.771] WbemLocator:IUnknown:QueryInterface (in: This=0x7129e04, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x74ae774 | out: ppvObject=0x74ae774*=0x6c3df4) returned 0x0 [0096.771] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3df4, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x74ae730 | out: ppvObject=0x74ae730*=0x0) returned 0x80004002 [0096.771] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3df4, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x74ae624 | out: ppvObject=0x74ae624*=0x0) returned 0x80004002 [0096.772] WbemLocator:IUnknown:AddRef (This=0x6c3df4) returned 0x3 [0096.772] CoGetContextToken (in: pToken=0x74ae5bc | out: pToken=0x74ae5bc) returned 0x0 [0096.772] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3df4, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x74ae5a4 | out: ppvObject=0x74ae5a4*=0x6c3d54) returned 0x0 [0096.772] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c3d54, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x74ae5ac | out: pCid=0x74ae5ac*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0096.772] WbemLocator:IUnknown:Release (This=0x6c3d54) returned 0x3 [0096.772] CoGetContextToken (in: pToken=0x74ae5b4 | out: pToken=0x74ae5b4) returned 0x0 [0096.772] WbemLocator:IUnknown:AddRef (This=0x6c3df4) returned 0x4 [0096.772] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3df4, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x74ae628 | out: ppvObject=0x74ae628*=0x6c3ddc) returned 0x0 [0096.772] WbemLocator:IUnknown:Release (This=0x6c3df4) returned 0x4 [0096.772] WbemLocator:IRpcOptions:Query (in: This=0x6c3ddc, pPrx=0x6c3df4, dwProperty=2, pdwValue=0x74ae64c | out: pdwValue=0x74ae64c) returned 0x80004002 [0096.772] WbemLocator:IUnknown:Release (This=0x6c3ddc) returned 0x3 [0096.772] WbemLocator:IUnknown:Release (This=0x6c3df4) returned 0x2 [0096.772] CoGetContextToken (in: pToken=0x74aea28 | out: pToken=0x74aea28) returned 0x0 [0096.772] CoGetContextToken (in: pToken=0x74ae9e8 | out: pToken=0x74ae9e8) returned 0x0 [0096.772] WbemLocator:IUnknown:AddRef (This=0x6c3df4) returned 0x3 [0096.772] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3df4, riid=0x74aea64*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x74aea60 | out: ppvObject=0x74aea60*=0x7129e04) returned 0x0 [0096.772] WbemLocator:IUnknown:Release (This=0x6c3df4) returned 0x3 [0096.773] WbemLocator:IUnknown:Release (This=0x7129e04) returned 0x2 [0096.773] WbemLocator:IUnknown:Release (This=0x7129e04) returned 0x1 [0096.773] CoUninitialize () Thread: id = 220 os_tid = 0x14c Thread: id = 228 os_tid = 0x944 [0100.283] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0100.621] GetForegroundWindow () returned 0x201f6 [0100.621] GetLastError () returned 0x0 [0100.623] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0100.623] GetLastError () returned 0x0 [0100.625] GetForegroundWindow () returned 0x201f6 [0100.625] GetLastError () returned 0x0 [0100.625] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0100.625] GetLastError () returned 0x0 [0101.044] GetForegroundWindow () returned 0x201f6 [0101.045] GetLastError () returned 0x0 [0101.045] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0101.046] GetLastError () returned 0x0 [0102.123] GetForegroundWindow () returned 0x201f6 [0102.123] GetLastError () returned 0x0 [0102.124] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0102.125] GetLastError () returned 0x0 [0102.451] GetForegroundWindow () returned 0x201f6 [0102.451] GetLastError () returned 0x0 [0102.451] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0102.451] GetLastError () returned 0x0 [0102.799] GetForegroundWindow () returned 0x20280 [0102.799] GetLastError () returned 0x0 [0102.799] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0102.799] GetLastError () returned 0x0 [0102.799] GetForegroundWindow () returned 0x201f6 [0102.799] GetLastError () returned 0x0 [0102.800] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0102.800] GetLastError () returned 0x0 [0103.148] GetForegroundWindow () returned 0x201f6 [0103.148] GetLastError () returned 0x0 [0103.148] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0103.148] GetLastError () returned 0x0 [0103.480] GetForegroundWindow () returned 0x201f6 [0103.480] GetLastError () returned 0x0 [0103.480] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0103.480] GetLastError () returned 0x0 [0103.893] GetForegroundWindow () returned 0x201f6 [0103.893] GetLastError () returned 0x0 [0103.893] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0103.894] GetLastError () returned 0x0 [0104.265] GetForegroundWindow () returned 0x20280 [0104.265] GetLastError () returned 0x0 [0104.265] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0104.265] GetLastError () returned 0x0 [0104.265] GetForegroundWindow () returned 0x201f6 [0104.265] GetLastError () returned 0x0 [0104.265] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0104.265] GetLastError () returned 0x0 [0104.606] GetForegroundWindow () returned 0x201f6 [0104.606] GetLastError () returned 0x0 [0104.606] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0104.606] GetLastError () returned 0x0 [0104.949] GetForegroundWindow () returned 0x201f6 [0104.949] GetLastError () returned 0x0 [0104.949] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0104.949] GetLastError () returned 0x0 [0105.278] GetForegroundWindow () returned 0x201f6 [0105.278] GetLastError () returned 0x0 [0105.278] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0105.278] GetLastError () returned 0x0 [0105.620] GetForegroundWindow () returned 0x20280 [0105.620] GetLastError () returned 0x0 [0105.620] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0105.620] GetLastError () returned 0x0 [0105.620] GetForegroundWindow () returned 0x201f6 [0105.620] GetLastError () returned 0x0 [0105.620] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0105.620] GetLastError () returned 0x0 [0105.948] GetForegroundWindow () returned 0x201f6 [0105.948] GetLastError () returned 0x0 [0105.948] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0105.949] GetLastError () returned 0x0 [0106.563] GetForegroundWindow () returned 0x201f6 [0106.563] GetLastError () returned 0x0 [0106.564] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0106.564] GetLastError () returned 0x0 [0106.941] GetForegroundWindow () returned 0x201f6 [0106.941] GetLastError () returned 0x0 [0106.941] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0106.941] GetLastError () returned 0x0 [0107.303] GetForegroundWindow () returned 0x20280 [0107.305] GetLastError () returned 0x0 [0107.305] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0107.305] GetLastError () returned 0x0 [0107.305] GetForegroundWindow () returned 0x201f6 [0107.305] GetLastError () returned 0x0 [0107.305] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0107.305] GetLastError () returned 0x0 [0107.619] GetForegroundWindow () returned 0x201f6 [0107.619] GetLastError () returned 0x0 [0107.619] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0107.619] GetLastError () returned 0x0 [0107.928] GetForegroundWindow () returned 0x201f6 [0107.928] GetLastError () returned 0x0 [0107.928] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0107.928] GetLastError () returned 0x0 [0108.241] GetForegroundWindow () returned 0x201f6 [0108.241] GetLastError () returned 0x0 [0108.241] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0108.241] GetLastError () returned 0x0 [0108.631] GetForegroundWindow () returned 0x20280 [0108.631] GetLastError () returned 0x0 [0108.631] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0108.631] GetLastError () returned 0x0 [0108.631] GetForegroundWindow () returned 0x201f6 [0108.631] GetLastError () returned 0x0 [0108.631] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0108.631] GetLastError () returned 0x0 [0108.943] GetForegroundWindow () returned 0x201f6 [0108.943] GetLastError () returned 0x0 [0108.943] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0108.943] GetLastError () returned 0x0 [0109.255] GetForegroundWindow () returned 0x201f6 [0109.255] GetLastError () returned 0x0 [0109.255] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0109.255] GetLastError () returned 0x0 [0109.598] GetForegroundWindow () returned 0x201f6 [0109.598] GetLastError () returned 0x0 [0109.598] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0109.598] GetLastError () returned 0x0 [0109.925] GetForegroundWindow () returned 0x20280 [0109.925] GetLastError () returned 0x0 [0109.925] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0109.925] GetLastError () returned 0x0 [0109.925] GetForegroundWindow () returned 0x201f6 [0109.925] GetLastError () returned 0x0 [0109.925] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0109.926] GetLastError () returned 0x0 [0110.255] GetForegroundWindow () returned 0x201f6 [0110.255] GetLastError () returned 0x0 [0110.255] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0110.255] GetLastError () returned 0x0 [0110.565] GetForegroundWindow () returned 0x201f6 [0110.565] GetLastError () returned 0x0 [0110.565] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0110.565] GetLastError () returned 0x0 [0110.908] GetForegroundWindow () returned 0x201f6 [0110.908] GetLastError () returned 0x0 [0110.908] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0110.908] GetLastError () returned 0x0 [0111.251] GetForegroundWindow () returned 0x20280 [0111.251] GetLastError () returned 0x0 [0111.251] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0111.251] GetLastError () returned 0x0 [0111.252] GetForegroundWindow () returned 0x201f6 [0111.252] GetLastError () returned 0x0 [0111.252] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0111.252] GetLastError () returned 0x0 [0111.563] GetForegroundWindow () returned 0x201f6 [0111.563] GetLastError () returned 0x0 [0111.563] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0111.563] GetLastError () returned 0x0 [0111.875] GetForegroundWindow () returned 0x201f6 [0111.875] GetLastError () returned 0x0 [0111.875] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0111.875] GetLastError () returned 0x0 [0112.203] GetForegroundWindow () returned 0x201f6 [0112.203] GetLastError () returned 0x0 [0112.203] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0112.203] GetLastError () returned 0x0 [0112.515] GetForegroundWindow () returned 0x20280 [0112.515] GetLastError () returned 0x0 [0112.515] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0112.515] GetLastError () returned 0x0 [0112.515] GetForegroundWindow () returned 0x201f6 [0112.515] GetLastError () returned 0x0 [0112.515] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0112.515] GetLastError () returned 0x0 [0112.827] GetForegroundWindow () returned 0x201f6 [0112.827] GetLastError () returned 0x0 [0112.827] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0112.827] GetLastError () returned 0x0 [0113.139] GetForegroundWindow () returned 0x201f6 [0113.139] GetLastError () returned 0x0 [0113.139] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0113.139] GetLastError () returned 0x0 [0113.451] GetForegroundWindow () returned 0x201f6 [0113.451] GetLastError () returned 0x0 [0113.451] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0113.451] GetLastError () returned 0x0 [0113.763] GetForegroundWindow () returned 0x20280 [0113.763] GetLastError () returned 0x0 [0113.763] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0113.763] GetLastError () returned 0x0 [0113.763] GetForegroundWindow () returned 0x201f6 [0113.763] GetLastError () returned 0x0 [0113.763] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0113.763] GetLastError () returned 0x0 [0114.076] GetForegroundWindow () returned 0x201f6 [0114.076] GetLastError () returned 0x0 [0114.076] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0114.076] GetLastError () returned 0x0 [0114.387] GetForegroundWindow () returned 0x201f6 [0114.387] GetLastError () returned 0x0 [0114.387] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0114.387] GetLastError () returned 0x0 [0114.699] GetForegroundWindow () returned 0x201f6 [0114.699] GetLastError () returned 0x0 [0114.699] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0114.699] GetLastError () returned 0x0 [0115.058] GetForegroundWindow () returned 0x20280 [0115.058] GetLastError () returned 0x0 [0115.058] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0115.058] GetLastError () returned 0x0 [0115.058] GetForegroundWindow () returned 0x201f6 [0115.058] GetLastError () returned 0x0 [0115.058] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0115.058] GetLastError () returned 0x0 [0115.370] GetForegroundWindow () returned 0x201f6 [0115.370] GetLastError () returned 0x0 [0115.370] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0115.370] GetLastError () returned 0x0 [0115.681] GetForegroundWindow () returned 0x201f6 [0115.682] GetLastError () returned 0x0 [0115.682] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0115.682] GetLastError () returned 0x0 [0116.009] GetForegroundWindow () returned 0x201f6 [0116.009] GetLastError () returned 0x0 [0116.009] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0116.009] GetLastError () returned 0x0 [0116.338] GetForegroundWindow () returned 0x20280 [0116.338] GetLastError () returned 0x0 [0116.339] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0116.339] GetLastError () returned 0x0 [0116.339] GetForegroundWindow () returned 0x201f6 [0116.339] GetLastError () returned 0x0 [0116.339] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0116.339] GetLastError () returned 0x0 [0116.680] GetForegroundWindow () returned 0x201f6 [0116.680] GetLastError () returned 0x0 [0116.680] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0116.680] GetLastError () returned 0x0 [0117.012] GetForegroundWindow () returned 0x201f6 [0117.013] GetLastError () returned 0x0 [0117.013] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0117.013] GetLastError () returned 0x0 [0117.320] GetForegroundWindow () returned 0x201f6 [0117.320] GetLastError () returned 0x0 [0117.320] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0117.320] GetLastError () returned 0x0 [0117.634] GetForegroundWindow () returned 0x20280 [0117.634] GetLastError () returned 0x0 [0117.634] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0117.634] GetLastError () returned 0x0 [0117.634] GetForegroundWindow () returned 0x201f6 [0117.634] GetLastError () returned 0x0 [0117.634] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0117.634] GetLastError () returned 0x0 [0117.959] GetForegroundWindow () returned 0x201f6 [0117.959] GetLastError () returned 0x0 [0117.959] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0117.960] GetLastError () returned 0x0 [0118.302] GetForegroundWindow () returned 0x201f6 [0118.303] GetLastError () returned 0x0 [0118.303] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0118.303] GetLastError () returned 0x0 [0118.646] GetForegroundWindow () returned 0x201f6 [0118.646] GetLastError () returned 0x0 [0118.646] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0118.646] GetLastError () returned 0x0 [0118.973] GetForegroundWindow () returned 0x20280 [0118.973] GetLastError () returned 0x0 [0118.973] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0118.973] GetLastError () returned 0x0 [0118.973] GetForegroundWindow () returned 0x201f6 [0118.973] GetLastError () returned 0x0 [0118.974] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0118.974] GetLastError () returned 0x0 [0119.316] GetForegroundWindow () returned 0x201f6 [0119.317] GetLastError () returned 0x0 [0119.317] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0119.317] GetLastError () returned 0x0 [0119.628] GetForegroundWindow () returned 0x201f6 [0119.628] GetLastError () returned 0x0 [0119.628] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0119.628] GetLastError () returned 0x0 [0119.956] GetForegroundWindow () returned 0x201f6 [0119.956] GetLastError () returned 0x0 [0119.956] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0119.956] GetLastError () returned 0x0 [0120.284] GetForegroundWindow () returned 0x20280 [0120.284] GetLastError () returned 0x0 [0120.284] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0120.284] GetLastError () returned 0x0 [0120.284] GetForegroundWindow () returned 0x201f6 [0120.284] GetLastError () returned 0x0 [0120.284] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0120.284] GetLastError () returned 0x0 [0120.615] GetForegroundWindow () returned 0x201f6 [0120.615] GetLastError () returned 0x0 [0120.615] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0120.615] GetLastError () returned 0x0 [0120.923] GetForegroundWindow () returned 0x201f6 [0120.923] GetLastError () returned 0x0 [0120.923] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0120.923] GetLastError () returned 0x0 [0121.261] GetForegroundWindow () returned 0x201f6 [0121.261] GetLastError () returned 0x0 [0121.261] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0121.261] GetLastError () returned 0x0 [0121.578] GetForegroundWindow () returned 0x20280 [0121.579] GetLastError () returned 0x0 [0121.579] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0121.579] GetLastError () returned 0x0 [0121.579] GetForegroundWindow () returned 0x201f6 [0121.579] GetLastError () returned 0x0 [0121.579] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0121.579] GetLastError () returned 0x0 [0121.939] GetForegroundWindow () returned 0x201f6 [0121.939] GetLastError () returned 0x0 [0121.939] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0121.939] GetLastError () returned 0x0 [0122.268] GetForegroundWindow () returned 0x201f6 [0122.268] GetLastError () returned 0x0 [0122.268] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0122.268] GetLastError () returned 0x0 [0122.577] GetForegroundWindow () returned 0x201f6 [0122.577] GetLastError () returned 0x0 [0122.577] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0122.577] GetLastError () returned 0x0 [0122.905] GetForegroundWindow () returned 0x20280 [0122.905] GetLastError () returned 0x0 [0122.905] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0122.905] GetLastError () returned 0x0 [0122.905] GetForegroundWindow () returned 0x201f6 [0122.905] GetLastError () returned 0x0 [0122.905] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0122.905] GetLastError () returned 0x0 [0123.216] GetForegroundWindow () returned 0x201f6 [0123.216] GetLastError () returned 0x0 [0123.216] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0123.216] GetLastError () returned 0x0 [0123.544] GetForegroundWindow () returned 0x201f6 [0123.544] GetLastError () returned 0x0 [0123.544] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0123.544] GetLastError () returned 0x0 [0123.856] GetForegroundWindow () returned 0x201f6 [0123.856] GetLastError () returned 0x0 [0123.856] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0123.856] GetLastError () returned 0x0 [0124.168] GetForegroundWindow () returned 0x20280 [0124.168] GetLastError () returned 0x0 [0124.168] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0124.168] GetLastError () returned 0x0 [0124.168] GetForegroundWindow () returned 0x201f6 [0124.168] GetLastError () returned 0x0 [0124.168] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0124.168] GetLastError () returned 0x0 [0124.486] GetForegroundWindow () returned 0x201f6 [0124.486] GetLastError () returned 0x0 [0124.486] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0124.486] GetLastError () returned 0x0 [0124.811] GetForegroundWindow () returned 0x201f6 [0124.811] GetLastError () returned 0x0 [0124.811] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0124.811] GetLastError () returned 0x0 [0125.124] GetForegroundWindow () returned 0x201f6 [0125.124] GetLastError () returned 0x0 [0125.124] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0125.124] GetLastError () returned 0x0 [0125.432] GetForegroundWindow () returned 0x20280 [0125.432] GetLastError () returned 0x0 [0125.432] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0125.432] GetLastError () returned 0x0 [0125.432] GetForegroundWindow () returned 0x201f6 [0125.432] GetLastError () returned 0x0 [0125.432] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0125.432] GetLastError () returned 0x0 [0125.743] GetForegroundWindow () returned 0x201f6 [0125.744] GetLastError () returned 0x0 [0125.744] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0125.744] GetLastError () returned 0x0 [0126.057] GetForegroundWindow () returned 0x201f6 [0126.057] GetLastError () returned 0x0 [0126.057] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0126.057] GetLastError () returned 0x0 [0126.368] GetForegroundWindow () returned 0x201f6 [0126.368] GetLastError () returned 0x0 [0126.368] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0126.368] GetLastError () returned 0x0 [0126.679] GetForegroundWindow () returned 0x20280 [0126.680] GetLastError () returned 0x0 [0126.680] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0126.680] GetLastError () returned 0x0 [0126.680] GetForegroundWindow () returned 0x201f6 [0126.680] GetLastError () returned 0x0 [0126.680] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0126.680] GetLastError () returned 0x0 [0126.999] GetForegroundWindow () returned 0x201f6 [0126.999] GetLastError () returned 0x0 [0126.999] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0126.999] GetLastError () returned 0x0 [0127.322] GetForegroundWindow () returned 0x201f6 [0127.539] GetLastError () returned 0x0 [0127.539] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0127.539] GetLastError () returned 0x0 [0127.866] GetForegroundWindow () returned 0x201f6 [0127.866] GetLastError () returned 0x0 [0127.866] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0127.866] GetLastError () returned 0x0 [0128.203] GetForegroundWindow () returned 0x20280 [0128.203] GetLastError () returned 0x0 [0128.203] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0128.203] GetLastError () returned 0x0 [0128.203] GetForegroundWindow () returned 0x201f6 [0128.203] GetLastError () returned 0x0 [0128.203] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0128.203] GetLastError () returned 0x0 [0128.507] GetForegroundWindow () returned 0x201f6 [0128.507] GetLastError () returned 0x0 [0128.507] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0128.507] GetLastError () returned 0x0 [0128.817] GetForegroundWindow () returned 0x201f6 [0128.817] GetLastError () returned 0x0 [0128.817] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0128.817] GetLastError () returned 0x0 [0129.129] GetForegroundWindow () returned 0x201f6 [0129.129] GetLastError () returned 0x0 [0129.129] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0129.129] GetLastError () returned 0x0 [0129.441] GetForegroundWindow () returned 0x20280 [0129.441] GetLastError () returned 0x0 [0129.441] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0129.441] GetLastError () returned 0x0 [0129.441] GetForegroundWindow () returned 0x201f6 [0129.441] GetLastError () returned 0x0 [0129.441] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0129.441] GetLastError () returned 0x0 [0129.753] GetForegroundWindow () returned 0x201f6 [0129.753] GetLastError () returned 0x0 [0129.753] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0129.753] GetLastError () returned 0x0 [0130.066] GetForegroundWindow () returned 0x201f6 [0130.066] GetLastError () returned 0x0 [0130.066] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0130.066] GetLastError () returned 0x0 [0130.377] GetForegroundWindow () returned 0x201f6 [0130.377] GetLastError () returned 0x0 [0130.377] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0130.377] GetLastError () returned 0x0 [0130.689] GetForegroundWindow () returned 0x20280 [0130.689] GetLastError () returned 0x0 [0130.689] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0130.689] GetLastError () returned 0x0 [0130.690] GetForegroundWindow () returned 0x201f6 [0130.690] GetLastError () returned 0x0 [0130.690] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0130.690] GetLastError () returned 0x0 [0131.001] GetForegroundWindow () returned 0x201f6 [0131.001] GetLastError () returned 0x0 [0131.001] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0131.001] GetLastError () returned 0x0 [0131.313] GetForegroundWindow () returned 0x201f6 [0131.313] GetLastError () returned 0x0 [0131.314] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0131.314] GetLastError () returned 0x0 [0131.634] GetForegroundWindow () returned 0x201f6 [0131.634] GetLastError () returned 0x0 [0131.634] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0131.634] GetLastError () returned 0x0 [0131.937] GetForegroundWindow () returned 0x20280 [0131.937] GetLastError () returned 0x0 [0131.937] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0131.937] GetLastError () returned 0x0 [0131.937] GetForegroundWindow () returned 0x201f6 [0131.937] GetLastError () returned 0x0 [0131.937] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0131.937] GetLastError () returned 0x0 [0132.249] GetForegroundWindow () returned 0x201f6 [0132.249] GetLastError () returned 0x0 [0132.249] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0132.249] GetLastError () returned 0x0 [0132.561] GetForegroundWindow () returned 0x201f6 [0132.561] GetLastError () returned 0x0 [0132.561] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0132.561] GetLastError () returned 0x0 [0132.873] GetForegroundWindow () returned 0x201f6 [0132.873] GetLastError () returned 0x0 [0132.873] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0132.873] GetLastError () returned 0x0 [0133.185] GetForegroundWindow () returned 0x20280 [0133.185] GetLastError () returned 0x0 [0133.185] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0133.186] GetLastError () returned 0x0 [0133.186] GetForegroundWindow () returned 0x201f6 [0133.186] GetLastError () returned 0x0 [0133.186] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0133.186] GetLastError () returned 0x0 [0133.515] GetForegroundWindow () returned 0x201f6 [0133.515] GetLastError () returned 0x0 [0133.515] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0133.515] GetLastError () returned 0x0 [0133.825] GetForegroundWindow () returned 0x201f6 [0133.825] GetLastError () returned 0x0 [0133.825] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0133.825] GetLastError () returned 0x0 [0134.137] GetForegroundWindow () returned 0x201f6 [0134.137] GetLastError () returned 0x0 [0134.137] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0134.138] GetLastError () returned 0x0 [0134.448] GetForegroundWindow () returned 0x20280 [0134.449] GetLastError () returned 0x0 [0134.449] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0134.449] GetLastError () returned 0x0 [0134.449] GetForegroundWindow () returned 0x201f6 [0134.450] GetLastError () returned 0x0 [0134.450] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0134.450] GetLastError () returned 0x0 [0134.761] GetForegroundWindow () returned 0x201f6 [0134.761] GetLastError () returned 0x0 [0134.761] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0134.761] GetLastError () returned 0x0 [0135.073] GetForegroundWindow () returned 0x201f6 [0135.073] GetLastError () returned 0x0 [0135.073] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0135.073] GetLastError () returned 0x0 [0135.385] GetForegroundWindow () returned 0x201f6 [0135.385] GetLastError () returned 0x0 [0135.385] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0135.385] GetLastError () returned 0x0 [0135.697] GetForegroundWindow () returned 0x20280 [0135.697] GetLastError () returned 0x0 [0135.697] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0135.697] GetLastError () returned 0x0 [0135.697] GetForegroundWindow () returned 0x201f6 [0135.697] GetLastError () returned 0x0 [0135.697] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0135.697] GetLastError () returned 0x0 [0136.009] GetForegroundWindow () returned 0x201f6 [0136.009] GetLastError () returned 0x0 [0136.009] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0136.009] GetLastError () returned 0x0 [0136.329] GetForegroundWindow () returned 0x201f6 [0136.329] GetLastError () returned 0x0 [0136.329] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0136.329] GetLastError () returned 0x0 [0136.637] GetForegroundWindow () returned 0x201f6 [0136.637] GetLastError () returned 0x0 [0136.637] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0136.637] GetLastError () returned 0x0 [0136.945] GetForegroundWindow () returned 0x20280 [0136.945] GetLastError () returned 0x0 [0136.945] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0136.945] GetLastError () returned 0x0 [0136.946] GetForegroundWindow () returned 0x201f6 [0136.946] GetLastError () returned 0x0 [0136.946] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0136.946] GetLastError () returned 0x0 [0137.257] GetForegroundWindow () returned 0x201f6 [0137.257] GetLastError () returned 0x0 [0137.257] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0137.257] GetLastError () returned 0x0 [0137.568] GetForegroundWindow () returned 0x201f6 [0137.568] GetLastError () returned 0x0 [0137.568] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0137.569] GetLastError () returned 0x0 [0137.881] GetForegroundWindow () returned 0x201f6 [0137.881] GetLastError () returned 0x0 [0137.881] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0137.881] GetLastError () returned 0x0 [0138.194] GetForegroundWindow () returned 0x20280 [0138.194] GetLastError () returned 0x0 [0138.194] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0138.194] GetLastError () returned 0x0 [0138.195] GetForegroundWindow () returned 0x201f6 [0138.195] GetLastError () returned 0x0 [0138.195] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0138.195] GetLastError () returned 0x0 [0138.504] GetForegroundWindow () returned 0x201f6 [0138.504] GetLastError () returned 0x0 [0138.504] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0138.504] GetLastError () returned 0x0 [0138.817] GetForegroundWindow () returned 0x201f6 [0138.817] GetLastError () returned 0x0 [0138.817] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0138.817] GetLastError () returned 0x0 [0139.129] GetForegroundWindow () returned 0x201f6 [0139.129] GetLastError () returned 0x0 [0139.129] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0139.129] GetLastError () returned 0x0 [0139.441] GetForegroundWindow () returned 0x20280 [0139.441] GetLastError () returned 0x0 [0139.441] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0139.441] GetLastError () returned 0x0 [0139.442] GetForegroundWindow () returned 0x201f6 [0139.442] GetLastError () returned 0x0 [0139.442] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0139.442] GetLastError () returned 0x0 [0139.753] GetForegroundWindow () returned 0x201f6 [0139.753] GetLastError () returned 0x0 [0139.753] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0139.753] GetLastError () returned 0x0 [0140.069] GetForegroundWindow () returned 0x201f6 [0140.069] GetLastError () returned 0x0 [0140.069] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0140.069] GetLastError () returned 0x0 [0140.377] GetForegroundWindow () returned 0x201f6 [0140.377] GetLastError () returned 0x0 [0140.377] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0140.377] GetLastError () returned 0x0 [0140.691] GetForegroundWindow () returned 0x20280 [0140.691] GetLastError () returned 0x0 [0140.691] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0140.691] GetLastError () returned 0x0 [0140.692] GetForegroundWindow () returned 0x201f6 [0140.692] GetLastError () returned 0x0 [0140.692] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0140.692] GetLastError () returned 0x0 [0141.001] GetForegroundWindow () returned 0x201f6 [0141.001] GetLastError () returned 0x0 [0141.001] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0141.001] GetLastError () returned 0x0 [0141.313] GetForegroundWindow () returned 0x201f6 [0141.313] GetLastError () returned 0x0 [0141.313] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0141.313] GetLastError () returned 0x0 [0141.625] GetForegroundWindow () returned 0x201f6 [0141.625] GetLastError () returned 0x0 [0141.625] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0141.625] GetLastError () returned 0x0 [0141.937] GetForegroundWindow () returned 0x20280 [0141.937] GetLastError () returned 0x0 [0141.937] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0141.937] GetLastError () returned 0x0 [0141.937] GetForegroundWindow () returned 0x201f6 [0141.937] GetLastError () returned 0x0 [0141.937] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0141.937] GetLastError () returned 0x0 [0142.249] GetForegroundWindow () returned 0x201f6 [0142.249] GetLastError () returned 0x0 [0142.249] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0142.249] GetLastError () returned 0x0 [0142.560] GetForegroundWindow () returned 0x201f6 [0142.560] GetLastError () returned 0x0 [0142.561] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0142.561] GetLastError () returned 0x0 [0142.874] GetForegroundWindow () returned 0x201f6 [0142.874] GetLastError () returned 0x0 [0142.875] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0142.875] GetLastError () returned 0x0 [0143.185] GetForegroundWindow () returned 0x20280 [0143.185] GetLastError () returned 0x0 [0143.185] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0143.186] GetLastError () returned 0x0 [0143.186] GetForegroundWindow () returned 0x201f6 [0143.186] GetLastError () returned 0x0 [0143.186] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0143.186] GetLastError () returned 0x0 [0143.517] GetForegroundWindow () returned 0x201f6 [0143.517] GetLastError () returned 0x0 [0143.517] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0143.517] GetLastError () returned 0x0 [0143.824] GetForegroundWindow () returned 0x201f6 [0143.824] GetLastError () returned 0x0 [0143.824] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0143.824] GetLastError () returned 0x0 [0144.136] GetForegroundWindow () returned 0x201f6 [0144.137] GetLastError () returned 0x0 [0144.137] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0144.137] GetLastError () returned 0x0 [0144.448] GetForegroundWindow () returned 0x20280 [0144.448] GetLastError () returned 0x0 [0144.448] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0144.448] GetLastError () returned 0x0 [0144.448] GetForegroundWindow () returned 0x201f6 [0144.448] GetLastError () returned 0x0 [0144.448] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0144.448] GetLastError () returned 0x0 [0144.761] GetForegroundWindow () returned 0x201f6 [0144.761] GetLastError () returned 0x0 [0144.761] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0144.761] GetLastError () returned 0x0 [0145.087] GetForegroundWindow () returned 0x201f6 [0145.087] GetLastError () returned 0x0 [0145.087] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0145.087] GetLastError () returned 0x0 [0145.384] GetForegroundWindow () returned 0x201f6 [0145.384] GetLastError () returned 0x0 [0145.385] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0145.385] GetLastError () returned 0x0 [0145.696] GetForegroundWindow () returned 0x20280 [0145.696] GetLastError () returned 0x0 [0145.696] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0145.696] GetLastError () returned 0x0 [0145.696] GetForegroundWindow () returned 0x201f6 [0145.696] GetLastError () returned 0x0 [0145.697] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0145.697] GetLastError () returned 0x0 [0146.010] GetForegroundWindow () returned 0x201f6 [0146.010] GetLastError () returned 0x0 [0146.011] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0146.011] GetLastError () returned 0x0 [0146.320] GetForegroundWindow () returned 0x201f6 [0146.321] GetLastError () returned 0x0 [0146.321] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0146.321] GetLastError () returned 0x0 [0146.632] GetForegroundWindow () returned 0x201f6 [0146.632] GetLastError () returned 0x0 [0146.632] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0146.632] GetLastError () returned 0x0 [0146.944] GetForegroundWindow () returned 0x20280 [0146.944] GetLastError () returned 0x0 [0146.944] GetWindowTextA (in: hWnd=0x20280, lpString=0x6ee394, nMaxCount=255 | out: lpString="") returned 0 [0146.944] GetLastError () returned 0x0 [0146.944] GetForegroundWindow () returned 0x201f6 [0146.944] GetLastError () returned 0x0 [0146.945] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0146.945] GetLastError () returned 0x0 [0147.257] GetForegroundWindow () returned 0x201f6 [0147.257] GetLastError () returned 0x0 [0147.257] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0147.257] GetLastError () returned 0x0 [0147.568] GetForegroundWindow () returned 0x201f6 [0147.568] GetLastError () returned 0x0 [0147.568] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0147.568] GetLastError () returned 0x0 [0147.880] GetForegroundWindow () returned 0x201f6 [0147.881] GetLastError () returned 0x0 [0147.881] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0147.881] GetLastError () returned 0x0 [0148.199] GetForegroundWindow () returned 0x2021c [0148.199] GetLastError () returned 0x0 [0148.199] GetWindowTextA (in: hWnd=0x2021c, lpString=0x6ee394, nMaxCount=255 | out: lpString="Navigation Pane") returned 15 [0148.199] GetLastError () returned 0x0 [0148.199] GetForegroundWindow () returned 0x201f6 [0148.199] GetLastError () returned 0x0 [0148.199] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0148.199] GetLastError () returned 0x0 [0148.504] GetForegroundWindow () returned 0x201f6 [0148.504] GetLastError () returned 0x0 [0148.504] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0148.504] GetLastError () returned 0x0 [0148.816] GetForegroundWindow () returned 0x201f6 [0148.817] GetLastError () returned 0x0 [0148.817] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0148.817] GetLastError () returned 0x0 [0149.135] GetForegroundWindow () returned 0x201f6 [0149.135] GetLastError () returned 0x0 [0149.135] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0149.135] GetLastError () returned 0x0 [0149.440] GetForegroundWindow () returned 0x2021c [0149.441] GetLastError () returned 0x0 [0149.441] GetWindowTextA (in: hWnd=0x2021c, lpString=0x6ee394, nMaxCount=255 | out: lpString="Navigation Pane") returned 15 [0149.441] GetLastError () returned 0x0 [0149.441] GetForegroundWindow () returned 0x201f6 [0149.441] GetLastError () returned 0x0 [0149.441] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0149.441] GetLastError () returned 0x0 [0149.752] GetForegroundWindow () returned 0x201f6 [0149.752] GetLastError () returned 0x0 [0149.752] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0149.752] GetLastError () returned 0x0 [0150.064] GetForegroundWindow () returned 0x201f6 [0150.064] GetLastError () returned 0x0 [0150.064] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0150.064] GetLastError () returned 0x0 [0150.377] GetForegroundWindow () returned 0x201f6 [0150.377] GetLastError () returned 0x0 [0150.377] GetWindowTextA (in: hWnd=0x201f6, lpString=0x6ee394, nMaxCount=255 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0150.377] GetLastError () returned 0x0 Thread: id = 229 os_tid = 0x948 [0100.300] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0100.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.308] GetLastError () returned 0x3 [0100.308] SetErrorMode (uMode=0x0) returned 0x1 [0100.308] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\", nBufferLength=0x105, lpBuffer=0x760eb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\", lpFilePart=0x0) returned 0x2e [0100.308] GetLastError () returned 0x3 [0100.314] SetErrorMode (uMode=0x1) returned 0x0 [0100.314] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs"), fInfoLevelId=0x0, lpFileInformation=0x760ef98 | out: lpFileInformation=0x760ef98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.314] GetLastError () returned 0x3 [0100.314] SetErrorMode (uMode=0x0) returned 0x1 [0100.314] SetErrorMode (uMode=0x1) returned 0x0 [0100.314] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent"), fInfoLevelId=0x0, lpFileInformation=0x760ef98 | out: lpFileInformation=0x760ef98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.314] GetLastError () returned 0x2 [0100.314] SetErrorMode (uMode=0x0) returned 0x1 [0100.314] SetErrorMode (uMode=0x1) returned 0x0 [0100.314] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming" (normalized: "c:\\users\\jpenum\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x760ef98 | out: lpFileInformation=0x760ef98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x162a7ec0, ftCreationTime.dwHighDateTime=0x1d33edb, ftLastAccessTime.dwLowDateTime=0x25bea3f0, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x25bea3f0, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0100.314] GetLastError () returned 0x2 [0100.314] SetErrorMode (uMode=0x0) returned 0x1 [0100.314] SetErrorMode (uMode=0x1) returned 0x0 [0100.314] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData" (normalized: "c:\\users\\jpenum\\appdata"), fInfoLevelId=0x0, lpFileInformation=0x760ef98 | out: lpFileInformation=0x760ef98*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x162a7ec0, ftCreationTime.dwHighDateTime=0x1d33edb, ftLastAccessTime.dwLowDateTime=0x162ce020, ftLastAccessTime.dwHighDateTime=0x1d33edb, ftLastWriteTime.dwLowDateTime=0x7b4de3da, ftLastWriteTime.dwHighDateTime=0x1cb88f5, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0100.314] GetLastError () returned 0x2 [0100.314] SetErrorMode (uMode=0x0) returned 0x1 [0100.314] SetErrorMode (uMode=0x1) returned 0x0 [0100.315] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM" (normalized: "c:\\users\\jpenum"), fInfoLevelId=0x0, lpFileInformation=0x760ef98 | out: lpFileInformation=0x760ef98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16235aa0, ftCreationTime.dwHighDateTime=0x1d33edb, ftLastAccessTime.dwLowDateTime=0x167b6d80, ftLastAccessTime.dwHighDateTime=0x1d33edb, ftLastWriteTime.dwLowDateTime=0x167b6d80, ftLastWriteTime.dwHighDateTime=0x1d33edb, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0100.315] GetLastError () returned 0x2 [0100.315] SetErrorMode (uMode=0x0) returned 0x1 [0100.315] SetErrorMode (uMode=0x1) returned 0x0 [0100.315] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x760ef98 | out: lpFileInformation=0x760ef98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfa01468f, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x16235aa0, ftLastAccessTime.dwHighDateTime=0x1d33edb, ftLastWriteTime.dwLowDateTime=0x16235aa0, ftLastWriteTime.dwHighDateTime=0x1d33edb, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0100.315] GetLastError () returned 0x2 [0100.315] SetErrorMode (uMode=0x0) returned 0x1 [0100.316] CreateDirectoryW (lpPathName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent"), lpSecurityAttributes=0x0) returned 1 [0100.316] GetLastError () returned 0x2 [0100.316] CreateDirectoryW (lpPathName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs"), lpSecurityAttributes=0x0) returned 1 [0100.317] GetLastError () returned 0x2 [0100.336] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0100.336] GetLastError () returned 0x2 [0100.336] SetErrorMode (uMode=0x1) returned 0x0 [0100.337] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.337] GetLastError () returned 0x2 [0100.337] SetErrorMode (uMode=0x0) returned 0x1 [0100.450] GetLastError () returned 0x0 [0100.450] GetFileType (hFile=0x4a0) returned 0x1 [0100.450] SetErrorMode (uMode=0x0) returned 0x1 [0100.450] GetFileType (hFile=0x4a0) returned 0x1 [0100.451] WriteFile (in: hFile=0x4a0, lpBuffer=0x1c3fbf4*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x760ef58, lpOverlapped=0x0 | out: lpBuffer=0x1c3fbf4*, lpNumberOfBytesWritten=0x760ef58*=0x5, lpOverlapped=0x0) returned 1 [0100.452] GetLastError () returned 0x0 [0100.452] CloseHandle (hObject=0x4a0) returned 1 [0100.452] GetLastError () returned 0x0 [0105.494] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0105.494] GetLastError () returned 0x0 [0105.494] SetErrorMode (uMode=0x1) returned 0x0 [0105.494] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x6d8 [0105.494] GetLastError () returned 0x0 [0105.494] GetFileType (hFile=0x6d8) returned 0x1 [0105.494] SetErrorMode (uMode=0x0) returned 0x1 [0105.494] GetFileType (hFile=0x6d8) returned 0x1 [0105.494] GetFileSize (in: hFile=0x6d8, lpFileSizeHigh=0x760eff0 | out: lpFileSizeHigh=0x760eff0*=0x0) returned 0x5 [0105.494] GetLastError () returned 0x0 [0105.494] ReadFile (in: hFile=0x6d8, lpBuffer=0x1c7cdd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x760ef98, lpOverlapped=0x0 | out: lpBuffer=0x1c7cdd4*, lpNumberOfBytesRead=0x760ef98*=0x5, lpOverlapped=0x0) returned 1 [0105.495] GetLastError () returned 0x0 [0105.496] CloseHandle (hObject=0x6d8) returned 1 [0105.496] GetLastError () returned 0x0 [0105.497] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0105.497] GetLastError () returned 0x0 [0105.497] SetErrorMode (uMode=0x1) returned 0x0 [0105.497] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x6d8 [0105.498] GetLastError () returned 0xb7 [0105.498] GetFileType (hFile=0x6d8) returned 0x1 [0105.499] SetErrorMode (uMode=0x0) returned 0x1 [0105.499] GetFileType (hFile=0x6d8) returned 0x1 [0105.499] WriteFile (in: hFile=0x6d8, lpBuffer=0x1c881a0*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x760ef58, lpOverlapped=0x0 | out: lpBuffer=0x1c881a0*, lpNumberOfBytesWritten=0x760ef58*=0x10a, lpOverlapped=0x0) returned 1 [0105.500] GetLastError () returned 0xb7 [0105.500] CloseHandle (hObject=0x6d8) returned 1 [0105.501] GetLastError () returned 0xb7 [0105.501] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0105.501] GetLastError () returned 0xb7 [0105.501] SetErrorMode (uMode=0x1) returned 0x0 [0105.501] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29257d70, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x29257d70, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x2c23f830, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x10a)) returned 1 [0105.501] GetLastError () returned 0xb7 [0105.501] SetErrorMode (uMode=0x0) returned 0x1 [0110.945] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0110.945] GetLastError () returned 0xb7 [0110.945] SetErrorMode (uMode=0x1) returned 0x0 [0110.945] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0110.945] GetLastError () returned 0x0 [0110.945] GetFileType (hFile=0x614) returned 0x1 [0110.945] SetErrorMode (uMode=0x0) returned 0x1 [0110.945] GetFileType (hFile=0x614) returned 0x1 [0110.946] GetFileSize (in: hFile=0x614, lpFileSizeHigh=0x760eff0 | out: lpFileSizeHigh=0x760eff0*=0x0) returned 0x10a [0110.946] GetLastError () returned 0x0 [0110.946] ReadFile (in: hFile=0x614, lpBuffer=0x1cfb730, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x760ef98, lpOverlapped=0x0 | out: lpBuffer=0x1cfb730*, lpNumberOfBytesRead=0x760ef98*=0x10a, lpOverlapped=0x0) returned 1 [0110.947] GetLastError () returned 0x0 [0110.947] CloseHandle (hObject=0x614) returned 1 [0110.947] GetLastError () returned 0x0 [0110.949] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0110.949] GetLastError () returned 0x0 [0110.949] SetErrorMode (uMode=0x1) returned 0x0 [0110.949] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0110.950] GetLastError () returned 0xb7 [0110.950] GetFileType (hFile=0x614) returned 0x1 [0110.950] SetErrorMode (uMode=0x0) returned 0x1 [0110.950] GetFileType (hFile=0x614) returned 0x1 [0110.950] WriteFile (in: hFile=0x614, lpBuffer=0x1d1ca4c*, nNumberOfBytesToWrite=0x266, lpNumberOfBytesWritten=0x760ef58, lpOverlapped=0x0 | out: lpBuffer=0x1d1ca4c*, lpNumberOfBytesWritten=0x760ef58*=0x266, lpOverlapped=0x0) returned 1 [0110.952] GetLastError () returned 0xb7 [0110.952] CloseHandle (hObject=0x614) returned 1 [0110.952] GetLastError () returned 0xb7 [0110.953] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0110.953] GetLastError () returned 0xb7 [0110.953] SetErrorMode (uMode=0x1) returned 0x0 [0110.953] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29257d70, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x29257d70, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x2f201190, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x266)) returned 1 [0110.953] GetLastError () returned 0xb7 [0110.953] SetErrorMode (uMode=0x0) returned 0x1 [0115.947] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0115.947] GetLastError () returned 0xb7 [0115.947] SetErrorMode (uMode=0x1) returned 0x0 [0115.947] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0115.947] GetLastError () returned 0x0 [0115.947] GetFileType (hFile=0x614) returned 0x1 [0115.948] SetErrorMode (uMode=0x0) returned 0x1 [0115.948] GetFileType (hFile=0x614) returned 0x1 [0115.948] GetFileSize (in: hFile=0x614, lpFileSizeHigh=0x760eff0 | out: lpFileSizeHigh=0x760eff0*=0x0) returned 0x266 [0115.948] GetLastError () returned 0x0 [0115.948] ReadFile (in: hFile=0x614, lpBuffer=0x1d2acec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x760ef98, lpOverlapped=0x0 | out: lpBuffer=0x1d2acec*, lpNumberOfBytesRead=0x760ef98*=0x266, lpOverlapped=0x0) returned 1 [0115.949] GetLastError () returned 0x0 [0115.949] CloseHandle (hObject=0x614) returned 1 [0115.949] GetLastError () returned 0x0 [0115.953] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0115.953] GetLastError () returned 0x0 [0115.953] SetErrorMode (uMode=0x1) returned 0x0 [0115.953] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0115.957] GetLastError () returned 0xb7 [0115.957] GetFileType (hFile=0x614) returned 0x1 [0115.957] SetErrorMode (uMode=0x0) returned 0x1 [0115.957] GetFileType (hFile=0x614) returned 0x1 [0115.957] WriteFile (in: hFile=0x614, lpBuffer=0x1d650f4*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x760ef58, lpOverlapped=0x0 | out: lpBuffer=0x1d650f4*, lpNumberOfBytesWritten=0x760ef58*=0x3c2, lpOverlapped=0x0) returned 1 [0115.958] GetLastError () returned 0xb7 [0115.958] CloseHandle (hObject=0x614) returned 1 [0115.959] GetLastError () returned 0xb7 [0115.959] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0115.959] GetLastError () returned 0xb7 [0115.959] SetErrorMode (uMode=0x1) returned 0x0 [0115.959] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29257d70, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x29257d70, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x321c2af0, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x3c2)) returned 1 [0115.959] GetLastError () returned 0xb7 [0115.959] SetErrorMode (uMode=0x0) returned 0x1 [0120.970] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0120.970] GetLastError () returned 0xb7 [0120.970] SetErrorMode (uMode=0x1) returned 0x0 [0120.970] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0120.970] GetLastError () returned 0x0 [0120.970] GetFileType (hFile=0x614) returned 0x1 [0120.970] SetErrorMode (uMode=0x0) returned 0x1 [0120.970] GetFileType (hFile=0x614) returned 0x1 [0120.970] GetFileSize (in: hFile=0x614, lpFileSizeHigh=0x760eff0 | out: lpFileSizeHigh=0x760eff0*=0x0) returned 0x3c2 [0120.970] GetLastError () returned 0x0 [0120.970] ReadFile (in: hFile=0x614, lpBuffer=0x1d7481c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x760ef98, lpOverlapped=0x0 | out: lpBuffer=0x1d7481c*, lpNumberOfBytesRead=0x760ef98*=0x3c2, lpOverlapped=0x0) returned 1 [0120.971] GetLastError () returned 0x0 [0120.971] CloseHandle (hObject=0x614) returned 1 [0120.972] GetLastError () returned 0x0 [0121.128] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0121.128] GetLastError () returned 0x0 [0121.128] SetErrorMode (uMode=0x1) returned 0x0 [0121.128] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8bc [0121.129] GetLastError () returned 0xb7 [0121.129] GetFileType (hFile=0x8bc) returned 0x1 [0121.129] SetErrorMode (uMode=0x0) returned 0x1 [0121.129] GetFileType (hFile=0x8bc) returned 0x1 [0121.129] WriteFile (in: hFile=0x8bc, lpBuffer=0x1c0ad70*, nNumberOfBytesToWrite=0x51e, lpNumberOfBytesWritten=0x760ef58, lpOverlapped=0x0 | out: lpBuffer=0x1c0ad70*, lpNumberOfBytesWritten=0x760ef58*=0x51e, lpOverlapped=0x0) returned 1 [0121.130] GetLastError () returned 0xb7 [0121.130] CloseHandle (hObject=0x8bc) returned 1 [0121.131] GetLastError () returned 0xb7 [0121.131] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0121.131] GetLastError () returned 0xb7 [0121.131] SetErrorMode (uMode=0x1) returned 0x0 [0121.131] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29257d70, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x29257d70, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x35327370, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x51e)) returned 1 [0121.131] GetLastError () returned 0xb7 [0121.131] SetErrorMode (uMode=0x0) returned 0x1 [0126.134] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0126.134] GetLastError () returned 0xb7 [0126.134] SetErrorMode (uMode=0x1) returned 0x0 [0126.134] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5d0 [0126.134] GetLastError () returned 0x0 [0126.134] GetFileType (hFile=0x5d0) returned 0x1 [0126.134] SetErrorMode (uMode=0x0) returned 0x1 [0126.134] GetFileType (hFile=0x5d0) returned 0x1 [0126.134] GetFileSize (in: hFile=0x5d0, lpFileSizeHigh=0x760eff0 | out: lpFileSizeHigh=0x760eff0*=0x0) returned 0x51e [0126.134] GetLastError () returned 0x0 [0126.134] ReadFile (in: hFile=0x5d0, lpBuffer=0x1c1cd30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x760ef98, lpOverlapped=0x0 | out: lpBuffer=0x1c1cd30*, lpNumberOfBytesRead=0x760ef98*=0x51e, lpOverlapped=0x0) returned 1 [0126.135] GetLastError () returned 0x0 [0126.135] CloseHandle (hObject=0x5d0) returned 1 [0126.135] GetLastError () returned 0x0 [0126.137] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0126.138] GetLastError () returned 0x0 [0126.138] SetErrorMode (uMode=0x1) returned 0x0 [0126.138] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5d0 [0126.139] GetLastError () returned 0xb7 [0126.139] GetFileType (hFile=0x5d0) returned 0x1 [0126.139] SetErrorMode (uMode=0x0) returned 0x1 [0126.139] GetFileType (hFile=0x5d0) returned 0x1 [0126.139] WriteFile (in: hFile=0x5d0, lpBuffer=0x1c8b804*, nNumberOfBytesToWrite=0x67a, lpNumberOfBytesWritten=0x760ef58, lpOverlapped=0x0 | out: lpBuffer=0x1c8b804*, lpNumberOfBytesWritten=0x760ef58*=0x67a, lpOverlapped=0x0) returned 1 [0126.140] GetLastError () returned 0xb7 [0126.140] CloseHandle (hObject=0x5d0) returned 1 [0126.141] GetLastError () returned 0xb7 [0126.141] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0126.141] GetLastError () returned 0xb7 [0126.141] SetErrorMode (uMode=0x1) returned 0x0 [0126.141] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29257d70, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x29257d70, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x382e8cd0, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x67a)) returned 1 [0126.142] GetLastError () returned 0xb7 [0126.142] SetErrorMode (uMode=0x0) returned 0x1 [0131.142] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0131.142] GetLastError () returned 0xb7 [0131.142] SetErrorMode (uMode=0x1) returned 0x0 [0131.142] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2f8 [0131.142] GetLastError () returned 0x0 [0131.142] GetFileType (hFile=0x2f8) returned 0x1 [0131.142] SetErrorMode (uMode=0x0) returned 0x1 [0131.142] GetFileType (hFile=0x2f8) returned 0x1 [0131.143] GetFileSize (in: hFile=0x2f8, lpFileSizeHigh=0x760eff0 | out: lpFileSizeHigh=0x760eff0*=0x0) returned 0x67a [0131.143] GetLastError () returned 0x0 [0131.143] ReadFile (in: hFile=0x2f8, lpBuffer=0x1c9b0f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x760ef98, lpOverlapped=0x0 | out: lpBuffer=0x1c9b0f8*, lpNumberOfBytesRead=0x760ef98*=0x67a, lpOverlapped=0x0) returned 1 [0131.145] GetLastError () returned 0x0 [0131.145] CloseHandle (hObject=0x2f8) returned 1 [0131.146] GetLastError () returned 0x0 [0131.152] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0131.152] GetLastError () returned 0x0 [0131.152] SetErrorMode (uMode=0x1) returned 0x0 [0131.153] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2f8 [0131.157] GetLastError () returned 0xb7 [0131.157] GetFileType (hFile=0x2f8) returned 0x1 [0131.157] SetErrorMode (uMode=0x0) returned 0x1 [0131.158] GetFileType (hFile=0x2f8) returned 0x1 [0131.158] WriteFile (in: hFile=0x2f8, lpBuffer=0x1d207c4*, nNumberOfBytesToWrite=0x7d6, lpNumberOfBytesWritten=0x760ef58, lpOverlapped=0x0 | out: lpBuffer=0x1d207c4*, lpNumberOfBytesWritten=0x760ef58*=0x7d6, lpOverlapped=0x0) returned 1 [0131.160] GetLastError () returned 0xb7 [0131.161] CloseHandle (hObject=0x2f8) returned 1 [0131.162] GetLastError () returned 0xb7 [0131.162] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0131.163] GetLastError () returned 0xb7 [0131.163] SetErrorMode (uMode=0x1) returned 0x0 [0131.163] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29257d70, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x29257d70, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x3b2d0790, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x7d6)) returned 1 [0131.163] GetLastError () returned 0xb7 [0131.163] SetErrorMode (uMode=0x0) returned 0x1 [0136.166] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0136.166] GetLastError () returned 0xb7 [0136.166] SetErrorMode (uMode=0x1) returned 0x0 [0136.167] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5d0 [0136.167] GetLastError () returned 0x0 [0136.167] GetFileType (hFile=0x5d0) returned 0x1 [0136.167] SetErrorMode (uMode=0x0) returned 0x1 [0136.168] GetFileType (hFile=0x5d0) returned 0x1 [0136.168] GetFileSize (in: hFile=0x5d0, lpFileSizeHigh=0x760eff0 | out: lpFileSizeHigh=0x760eff0*=0x0) returned 0x7d6 [0136.168] GetLastError () returned 0x0 [0136.168] ReadFile (in: hFile=0x5d0, lpBuffer=0x1d30ba8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x760ef98, lpOverlapped=0x0 | out: lpBuffer=0x1d30ba8*, lpNumberOfBytesRead=0x760ef98*=0x7d6, lpOverlapped=0x0) returned 1 [0136.171] GetLastError () returned 0x0 [0136.171] CloseHandle (hObject=0x5d0) returned 1 [0136.171] GetLastError () returned 0x0 [0136.181] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0136.181] GetLastError () returned 0x0 [0136.181] SetErrorMode (uMode=0x1) returned 0x0 [0136.181] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5d0 [0136.183] GetLastError () returned 0xb7 [0136.183] GetFileType (hFile=0x5d0) returned 0x1 [0136.183] SetErrorMode (uMode=0x0) returned 0x1 [0136.183] GetFileType (hFile=0x5d0) returned 0x1 [0136.183] WriteFile (in: hFile=0x5d0, lpBuffer=0x1dcf360*, nNumberOfBytesToWrite=0x932, lpNumberOfBytesWritten=0x760ef58, lpOverlapped=0x0 | out: lpBuffer=0x1dcf360*, lpNumberOfBytesWritten=0x760ef58*=0x932, lpOverlapped=0x0) returned 1 [0136.184] GetLastError () returned 0xb7 [0136.184] CloseHandle (hObject=0x5d0) returned 1 [0136.186] GetLastError () returned 0xb7 [0136.186] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0136.186] GetLastError () returned 0xb7 [0136.186] SetErrorMode (uMode=0x1) returned 0x0 [0136.186] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29257d70, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x29257d70, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x3e2b8250, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x932)) returned 1 [0136.186] GetLastError () returned 0xb7 [0136.186] SetErrorMode (uMode=0x0) returned 0x1 [0141.188] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0141.188] GetLastError () returned 0xb7 [0141.188] SetErrorMode (uMode=0x1) returned 0x0 [0141.189] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f0 [0141.190] GetLastError () returned 0x0 [0141.190] GetFileType (hFile=0x3f0) returned 0x1 [0141.191] SetErrorMode (uMode=0x0) returned 0x1 [0141.191] GetFileType (hFile=0x3f0) returned 0x1 [0141.191] GetFileSize (in: hFile=0x3f0, lpFileSizeHigh=0x760eff0 | out: lpFileSizeHigh=0x760eff0*=0x0) returned 0x932 [0141.191] GetLastError () returned 0x0 [0141.192] ReadFile (in: hFile=0x3f0, lpBuffer=0x1ddfae8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x760ef98, lpOverlapped=0x0 | out: lpBuffer=0x1ddfae8*, lpNumberOfBytesRead=0x760ef98*=0x932, lpOverlapped=0x0) returned 1 [0141.195] GetLastError () returned 0x0 [0141.195] CloseHandle (hObject=0x3f0) returned 1 [0141.197] GetLastError () returned 0x0 [0141.217] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0141.217] GetLastError () returned 0x0 [0141.217] SetErrorMode (uMode=0x1) returned 0x0 [0141.217] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f0 [0141.219] GetLastError () returned 0xb7 [0141.219] GetFileType (hFile=0x3f0) returned 0x1 [0141.219] SetErrorMode (uMode=0x0) returned 0x1 [0141.219] GetFileType (hFile=0x3f0) returned 0x1 [0141.219] WriteFile (in: hFile=0x3f0, lpBuffer=0x1c98154*, nNumberOfBytesToWrite=0xa8e, lpNumberOfBytesWritten=0x760ef58, lpOverlapped=0x0 | out: lpBuffer=0x1c98154*, lpNumberOfBytesWritten=0x760ef58*=0xa8e, lpOverlapped=0x0) returned 1 [0141.220] GetLastError () returned 0xb7 [0141.220] CloseHandle (hObject=0x3f0) returned 1 [0141.222] GetLastError () returned 0xb7 [0141.222] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0141.222] GetLastError () returned 0xb7 [0141.222] SetErrorMode (uMode=0x1) returned 0x0 [0141.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29257d70, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x29257d70, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x412c5e70, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0xa8e)) returned 1 [0141.222] GetLastError () returned 0xb7 [0141.222] SetErrorMode (uMode=0x0) returned 0x1 [0146.227] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0146.227] GetLastError () returned 0xb7 [0146.227] SetErrorMode (uMode=0x1) returned 0x0 [0146.227] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f0 [0146.227] GetLastError () returned 0x0 [0146.227] GetFileType (hFile=0x3f0) returned 0x1 [0146.228] SetErrorMode (uMode=0x0) returned 0x1 [0146.228] GetFileType (hFile=0x3f0) returned 0x1 [0146.228] GetFileSize (in: hFile=0x3f0, lpFileSizeHigh=0x760eff0 | out: lpFileSizeHigh=0x760eff0*=0x0) returned 0xa8e [0146.228] GetLastError () returned 0x0 [0146.228] ReadFile (in: hFile=0x3f0, lpBuffer=0x1caf92c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x760ef98, lpOverlapped=0x0 | out: lpBuffer=0x1caf92c*, lpNumberOfBytesRead=0x760ef98*=0xa8e, lpOverlapped=0x0) returned 1 [0146.231] GetLastError () returned 0x0 [0146.231] CloseHandle (hObject=0x3f0) returned 1 [0146.231] GetLastError () returned 0x0 [0146.240] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0146.240] GetLastError () returned 0x0 [0146.240] SetErrorMode (uMode=0x1) returned 0x0 [0146.240] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f0 [0146.243] GetLastError () returned 0xb7 [0146.243] GetFileType (hFile=0x3f0) returned 0x1 [0146.243] SetErrorMode (uMode=0x0) returned 0x1 [0146.243] GetFileType (hFile=0x3f0) returned 0x1 [0146.243] WriteFile (in: hFile=0x3f0, lpBuffer=0x1d802bc*, nNumberOfBytesToWrite=0xbea, lpNumberOfBytesWritten=0x760ef58, lpOverlapped=0x0 | out: lpBuffer=0x1d802bc*, lpNumberOfBytesWritten=0x760ef58*=0xbea, lpOverlapped=0x0) returned 1 [0146.244] GetLastError () returned 0xb7 [0146.244] CloseHandle (hObject=0x3f0) returned 1 [0146.246] GetLastError () returned 0xb7 [0146.246] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", nBufferLength=0x105, lpBuffer=0x760eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019", lpFilePart=0x0) returned 0x38 [0146.246] GetLastError () returned 0xb7 [0146.246] SetErrorMode (uMode=0x1) returned 0x0 [0146.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Logs\\21-01-2019" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\logs\\21-01-2019"), fInfoLevelId=0x0, lpFileInformation=0x760eff0 | out: lpFileInformation=0x760eff0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29257d70, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x29257d70, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x442ad930, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0xbea)) returned 1 [0146.246] GetLastError () returned 0xb7 [0146.246] SetErrorMode (uMode=0x0) returned 0x1 Thread: id = 230 os_tid = 0x950 [0100.555] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0100.574] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0100.574] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0100.575] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0100.575] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0100.575] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0100.576] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0100.576] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0100.578] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0100.578] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0100.578] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0102.129] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0102.130] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0102.130] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0102.130] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0102.131] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0102.131] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0102.131] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0102.131] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0102.131] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0102.131] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0103.183] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0103.184] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0103.184] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0103.184] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0103.185] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0103.185] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0103.185] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0103.185] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0103.185] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0103.185] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0104.262] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0104.263] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0104.263] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0104.264] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0104.264] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0104.264] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0104.264] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0104.264] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0104.264] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0104.265] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0105.304] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0105.305] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0105.305] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0105.306] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0105.306] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0105.306] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0105.306] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0105.307] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0105.307] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0105.307] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0106.697] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0106.698] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0106.698] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0106.698] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0106.699] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0106.701] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0106.702] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0106.702] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0106.705] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0106.705] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0107.710] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0107.711] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0107.711] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0107.711] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0107.712] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0107.712] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0107.712] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0107.712] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0107.712] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0107.712] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0108.805] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0108.806] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0108.806] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0108.806] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0108.807] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0108.807] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0108.807] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0108.807] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0108.807] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0108.807] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0109.832] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0109.833] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0109.833] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0109.834] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0109.834] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0109.834] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0109.834] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0109.834] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0109.834] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0109.834] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0110.861] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0110.862] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0110.862] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0110.862] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0110.863] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0110.863] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0110.863] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0110.863] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0110.863] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0110.863] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0111.875] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0111.876] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0111.876] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0111.876] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0111.877] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0111.877] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0111.877] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0111.877] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0111.877] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0111.877] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0112.889] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0112.890] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0112.890] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0112.890] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0112.891] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0112.891] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0112.891] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0112.891] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0112.891] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0112.891] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0113.903] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0113.904] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0113.904] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0113.905] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0113.905] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0113.905] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0113.905] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0113.905] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0113.905] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0113.905] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0114.917] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0114.918] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0114.918] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0114.918] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0114.919] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0114.919] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0114.919] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0114.919] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0114.919] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0114.919] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0115.960] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0115.963] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0115.963] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0115.963] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0115.964] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0115.964] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0115.964] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0115.964] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0115.964] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0115.964] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0117.010] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0117.011] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0117.011] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0117.012] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0117.012] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0117.012] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0117.012] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0117.012] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0117.012] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0117.012] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0118.056] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0118.056] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0118.057] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0118.057] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0118.057] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0118.057] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0118.058] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0118.058] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0118.058] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0118.058] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0119.083] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0119.083] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0119.084] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0119.084] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0119.084] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0119.084] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0119.085] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0119.085] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0119.085] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0119.085] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0120.097] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0120.097] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0120.098] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0120.098] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0120.098] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0120.099] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0120.099] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0120.099] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0120.099] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0120.099] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0121.132] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0121.132] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0121.133] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0121.133] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0121.133] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0121.133] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0121.133] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0121.135] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0121.135] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0121.135] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0122.171] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0122.172] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0122.173] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0122.173] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0122.173] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0122.174] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0122.174] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0122.174] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0122.174] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0122.174] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0123.185] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0123.186] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0123.186] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0123.186] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0123.187] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0123.187] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0123.187] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0123.187] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0123.187] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0123.187] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0124.215] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0124.215] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0124.216] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0124.216] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0124.216] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0124.216] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0124.217] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0124.217] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0124.217] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0124.217] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0125.244] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0125.245] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0125.245] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0125.245] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0125.246] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0125.246] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0125.246] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0125.246] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0125.246] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0125.246] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0126.262] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0126.262] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0126.263] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0126.263] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0126.263] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0126.263] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0126.264] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0126.264] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0126.264] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0126.264] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0127.272] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0127.273] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0127.273] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0127.273] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0127.274] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0127.274] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0127.274] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0127.274] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0127.274] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0127.274] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0128.298] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0128.298] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0128.299] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0128.299] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0128.299] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0128.300] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0128.300] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0128.300] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0128.300] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0128.300] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0129.306] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0129.306] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0129.307] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0129.307] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0129.307] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0129.307] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0129.308] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0129.308] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0129.308] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0129.308] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0130.315] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0130.316] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0130.318] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0130.318] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0130.319] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0130.319] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0130.320] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0130.320] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0130.320] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0130.320] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0131.329] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0131.330] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0131.331] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0131.332] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0131.333] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0131.333] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0131.334] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0131.334] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0131.334] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0131.334] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0132.343] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0132.351] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0132.352] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0132.353] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0132.353] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0132.354] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0132.354] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0132.354] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0132.355] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0132.355] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0133.357] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0133.358] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0133.359] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0133.360] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0133.361] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0133.361] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0133.362] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0133.362] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0133.362] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0133.362] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0134.371] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0134.379] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0134.380] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0134.380] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0134.381] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0134.381] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0134.382] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0134.382] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0134.382] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0134.382] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0135.386] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0135.387] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0135.388] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0135.389] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0135.390] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0135.390] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0135.391] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0135.391] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0135.391] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0135.391] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0136.405] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0136.406] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0136.406] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0136.407] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0136.407] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0136.407] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0136.408] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0136.408] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0136.408] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0136.408] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0137.413] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0137.417] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0137.418] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0137.419] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0137.420] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0137.420] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0137.421] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0137.421] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0137.421] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0137.422] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0138.427] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0138.428] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0138.429] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0138.430] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0138.431] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0138.432] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0138.432] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0138.432] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0138.433] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0138.433] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0139.443] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0139.444] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0139.445] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0139.446] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0139.447] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0139.447] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0139.448] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0139.448] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0139.448] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0139.448] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0140.455] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0140.464] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0140.465] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0140.466] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0140.466] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0140.467] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0140.467] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0140.468] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0140.468] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0140.468] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0141.469] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0141.470] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0141.472] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0141.472] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0141.473] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0141.474] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0141.474] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0141.474] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0141.474] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0141.474] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0142.489] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0142.490] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0142.492] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0142.492] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0142.493] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0142.494] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0142.494] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0142.494] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0142.494] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0142.494] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0143.517] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0143.518] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0143.518] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0143.518] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0143.521] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0143.521] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0143.522] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0143.522] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0143.522] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0143.522] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0144.544] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0144.544] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0144.545] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0144.545] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0144.545] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0144.545] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0144.545] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0144.545] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0144.545] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0144.545] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0145.556] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0145.556] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0145.557] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0145.557] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0145.557] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0145.557] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0145.558] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0145.558] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0145.558] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0145.558] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0146.570] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0146.570] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0146.571] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0146.571] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0146.572] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0146.572] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0146.573] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0146.573] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0146.573] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0146.573] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0147.584] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0147.585] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0147.586] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0147.586] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0147.587] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0147.587] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0147.588] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0147.588] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0147.588] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0147.588] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0148.603] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0148.604] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0148.605] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0148.605] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0148.606] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0148.607] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0148.607] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0148.607] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0148.607] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0148.607] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0149.612] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0149.613] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0149.614] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0149.614] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0149.614] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0149.615] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0149.615] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0149.616] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0149.616] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0149.616] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0150.626] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0150.628] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0150.629] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0150.630] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0150.630] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0150.631] GetIfEntry (in: pIfRow=0x6e9b40 | out: pIfRow=0x6e9b40) returned 0x0 [0150.632] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef268 | out: pdecResult=0x77ef268) returned 0x0 [0150.632] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 [0150.632] VarDecMul (in: pdecLeft=0x77ef118, pdecRight=0x77ef108, pdecResult=0x77ef168 | out: pdecResult=0x77ef168) returned 0x0 [0150.632] VarR8FromDec (in: pdecIn=0x77ef118, pdblOut=0x77ef108 | out: pdblOut=0x77ef108) returned 0x0 Thread: id = 231 os_tid = 0x960 [0100.586] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0100.598] CoGetContextToken (in: pToken=0x70be9fc | out: pToken=0x70be9fc) returned 0x0 [0100.598] CoGetContextToken (in: pToken=0x70be9bc | out: pToken=0x70be9bc) returned 0x0 [0100.598] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x2 [0100.598] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131b58, riid=0x70bea38*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x70bea34 | out: ppvObject=0x70bea34*=0x7131b58) returned 0x0 [0100.598] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.598] WbemDefPath:IUnknown:AddRef (This=0x7131b58) returned 0x3 [0100.598] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x0) returned 0x0 [0100.598] WbemDefPath:IUnknown:Release (This=0x7131b58) returned 0x2 [0100.598] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x71108b8, puCount=0x70beb9c | out: puCount=0x70beb9c*=0x2) returned 0x0 [0100.598] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x70beb98*=0x0, pszText=0x0 | out: puBuffLength=0x70beb98*=0xf, pszText=0x0) returned 0x0 [0100.598] WbemDefPath:IWbemPath:GetText (in: This=0x71108b8, lFlags=4, puBuffLength=0x70beb98*=0xf, pszText="00000000000000" | out: puBuffLength=0x70beb98*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0100.599] CoGetObjectContext (in: riid=0x1c03670*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x70beb3c | out: ppv=0x70beb3c*=0x64863c) returned 0x0 [0100.599] IComThreadingInfo:GetCurrentApartmentType (in: This=0x64863c, pAptType=0x70beb34 | out: pAptType=0x70beb34*=1) returned 0x0 [0100.599] IUnknown:QueryInterface (in: This=0x64863c, riid=0x1c03658*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x70beb38 | out: ppvObject=0x70beb38*=0x0) returned 0x80004002 [0100.599] IUnknown:Release (This=0x64863c) returned 0x1 [0100.600] CoGetClassObject (in: rclsid=0x689aa4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6254a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x70be654 | out: ppv=0x70be654*=0x7110bb0) returned 0x0 [0100.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x7110bb0, riid=0x62637ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x70be484 | out: ppvObject=0x70be484*=0x0) returned 0x80004002 [0100.600] WbemDefPath:IClassFactory:CreateInstance (in: This=0x7110bb0, pUnkOuter=0x0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be4bc | out: ppvObject=0x70be4bc*=0x7131c90) returned 0x0 [0100.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131c90, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be260 | out: ppvObject=0x70be260*=0x7131c90) returned 0x0 [0100.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131c90, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x70be21c | out: ppvObject=0x70be21c*=0x0) returned 0x80004002 [0100.600] WbemDefPath:IUnknown:AddRef (This=0x7131c90) returned 0x3 [0100.600] CoGetContextToken (in: pToken=0x70be0a8 | out: pToken=0x70be0a8) returned 0x0 [0100.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131c90, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be090 | out: ppvObject=0x70be090*=0x6d77f8) returned 0x0 [0100.601] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d77f8, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x70be098 | out: pCid=0x70be098*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0100.601] WbemDefPath:IUnknown:Release (This=0x6d77f8) returned 0x3 [0100.601] CoGetContextToken (in: pToken=0x70be0a0 | out: pToken=0x70be0a0) returned 0x0 [0100.601] WbemDefPath:IUnknown:AddRef (This=0x7131c90) returned 0x4 [0100.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131c90, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be114 | out: ppvObject=0x70be114*=0x0) returned 0x80004002 [0100.601] WbemDefPath:IUnknown:Release (This=0x7131c90) returned 0x3 [0100.601] WbemDefPath:IUnknown:Release (This=0x7131c90) returned 0x2 [0100.601] WbemDefPath:IUnknown:Release (This=0x7110bb0) returned 0x0 [0100.601] WbemDefPath:IUnknown:Release (This=0x7131c90) returned 0x1 [0100.601] CoGetContextToken (in: pToken=0x70be950 | out: pToken=0x70be950) returned 0x0 [0100.601] CoGetContextToken (in: pToken=0x70be910 | out: pToken=0x70be910) returned 0x0 [0100.601] WbemDefPath:IUnknown:AddRef (This=0x7131c90) returned 0x2 [0100.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131c90, riid=0x70be98c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x70be988 | out: ppvObject=0x70be988*=0x7131c90) returned 0x0 [0100.601] WbemDefPath:IUnknown:Release (This=0x7131c90) returned 0x2 [0100.602] WbemDefPath:IUnknown:Release (This=0x7131c90) returned 0x1 [0100.602] CoGetContextToken (in: pToken=0x70be9d0 | out: pToken=0x70be9d0) returned 0x0 [0100.602] CoGetContextToken (in: pToken=0x70be990 | out: pToken=0x70be990) returned 0x0 [0100.602] WbemDefPath:IUnknown:AddRef (This=0x7131c90) returned 0x2 [0100.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x7131c90, riid=0x70bea0c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x70bea08 | out: ppvObject=0x70bea08*=0x7131c90) returned 0x0 [0100.602] WbemDefPath:IUnknown:Release (This=0x7131c90) returned 0x2 [0100.602] WbemDefPath:IUnknown:AddRef (This=0x7131c90) returned 0x3 [0100.602] WbemDefPath:IWbemPath:SetText (This=0x7131c90, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0100.602] WbemDefPath:IUnknown:Release (This=0x7131c90) returned 0x2 [0100.602] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70beb74 | out: puCount=0x70beb74*=0x2) returned 0x0 [0100.602] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70beb70*=0x0, pszText=0x0 | out: puBuffLength=0x70beb70*=0xf, pszText=0x0) returned 0x0 [0100.602] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70beb70*=0xf, pszText="00000000000000" | out: puBuffLength=0x70beb70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0100.602] CoGetObjectContext (in: riid=0x1c03670*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x70beb70 | out: ppv=0x70beb70*=0x64863c) returned 0x0 [0100.602] IComThreadingInfo:GetCurrentApartmentType (in: This=0x64863c, pAptType=0x70beb68 | out: pAptType=0x70beb68*=1) returned 0x0 [0100.602] IUnknown:QueryInterface (in: This=0x64863c, riid=0x1c03658*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x70beb6c | out: ppvObject=0x70beb6c*=0x0) returned 0x80004002 [0100.602] IUnknown:Release (This=0x64863c) returned 0x1 [0100.602] CoGetClassObject (in: rclsid=0x696464*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6254a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x70be9c0 | out: ppv=0x70be9c0*=0x71269c0) returned 0x0 [0100.602] WbemLocator:IUnknown:QueryInterface (in: This=0x71269c0, riid=0x62637ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x70be7f0 | out: ppvObject=0x70be7f0*=0x0) returned 0x80004002 [0100.603] WbemLocator:IClassFactory:CreateInstance (in: This=0x71269c0, pUnkOuter=0x0, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be828 | out: ppvObject=0x70be828*=0x7125ac8) returned 0x0 [0100.603] WbemLocator:IUnknown:QueryInterface (in: This=0x7125ac8, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be5cc | out: ppvObject=0x70be5cc*=0x7125ac8) returned 0x0 [0100.603] WbemLocator:IUnknown:QueryInterface (in: This=0x7125ac8, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x70be588 | out: ppvObject=0x70be588*=0x0) returned 0x80004002 [0100.603] WbemLocator:IUnknown:AddRef (This=0x7125ac8) returned 0x3 [0100.603] CoGetContextToken (in: pToken=0x70be414 | out: pToken=0x70be414) returned 0x0 [0100.603] WbemLocator:IUnknown:QueryInterface (in: This=0x7125ac8, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be3fc | out: ppvObject=0x70be3fc*=0x0) returned 0x80004002 [0100.603] CoGetContextToken (in: pToken=0x70be40c | out: pToken=0x70be40c) returned 0x0 [0100.603] WbemLocator:IUnknown:AddRef (This=0x7125ac8) returned 0x4 [0100.603] WbemLocator:IUnknown:QueryInterface (in: This=0x7125ac8, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be480 | out: ppvObject=0x70be480*=0x0) returned 0x80004002 [0100.603] WbemLocator:IUnknown:Release (This=0x7125ac8) returned 0x3 [0100.603] WbemLocator:IUnknown:Release (This=0x7125ac8) returned 0x2 [0100.604] WbemLocator:IUnknown:Release (This=0x71269c0) returned 0x0 [0100.604] WbemLocator:IUnknown:Release (This=0x7125ac8) returned 0x1 [0100.604] CoGetContextToken (in: pToken=0x70be918 | out: pToken=0x70be918) returned 0x0 [0100.604] CoGetContextToken (in: pToken=0x70be8d8 | out: pToken=0x70be8d8) returned 0x0 [0100.604] WbemLocator:IUnknown:AddRef (This=0x7125ac8) returned 0x2 [0100.604] WbemLocator:IUnknown:QueryInterface (in: This=0x7125ac8, riid=0x70be954*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x70be950 | out: ppvObject=0x70be950*=0x7125ac8) returned 0x0 [0100.604] WbemLocator:IUnknown:Release (This=0x7125ac8) returned 0x2 [0100.604] WbemLocator:IUnknown:Release (This=0x7125ac8) returned 0x1 [0100.604] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70beb48 | out: puCount=0x70beb48*=0x2) returned 0x0 [0100.604] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=8, puBuffLength=0x70beb44*=0x0, pszText=0x0 | out: puBuffLength=0x70beb44*=0xf, pszText=0x0) returned 0x0 [0100.604] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=8, puBuffLength=0x70beb44*=0xf, pszText="00000000000000" | out: puBuffLength=0x70beb44*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0100.604] CoCreateInstance (in: rclsid=0x6a3113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a3112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x70be620 | out: ppv=0x70be620*=0x7125ad8) returned 0x0 [0100.604] WbemLocator:IWbemLocator:ConnectServer (in: This=0x7125ad8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x70be66c | out: ppNamespace=0x70be66c*=0x7131de4) returned 0x0 [0100.698] WbemLocator:IUnknown:QueryInterface (in: This=0x7131de4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be53c | out: ppvObject=0x70be53c*=0x6c4284) returned 0x0 [0100.698] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c4284, pProxy=0x7131de4, pAuthnSvc=0x70be584, pAuthzSvc=0x70be580, pServerPrincName=0x70be590, pAuthnLevel=0x70be588, pImpLevel=0x70be574, pAuthInfo=0x70be578, pCapabilites=0x70be57c | out: pAuthnSvc=0x70be584*=0xa, pAuthzSvc=0x70be580*=0x0, pServerPrincName=0x70be590, pAuthnLevel=0x70be588*=0x6, pImpLevel=0x70be574*=0x2, pAuthInfo=0x70be578, pCapabilites=0x70be57c*=0x1) returned 0x0 [0100.698] WbemLocator:IUnknown:Release (This=0x6c4284) returned 0x1 [0100.698] WbemLocator:IUnknown:QueryInterface (in: This=0x7131de4, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be530 | out: ppvObject=0x70be530*=0x6c42a4) returned 0x0 [0100.698] WbemLocator:IUnknown:QueryInterface (in: This=0x7131de4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be52c | out: ppvObject=0x70be52c*=0x6c4284) returned 0x0 [0100.698] WbemLocator:IClientSecurity:SetBlanket (This=0x6c4284, pProxy=0x7131de4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0100.699] WbemLocator:IUnknown:Release (This=0x6c4284) returned 0x2 [0100.699] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x1 [0100.699] CoTaskMemFree (pv=0x6e0e78) [0100.699] WbemLocator:IUnknown:Release (This=0x7125ad8) returned 0x0 [0100.699] WbemLocator:IUnknown:QueryInterface (in: This=0x7131de4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70bdeec | out: ppvObject=0x70bdeec*=0x6c42a4) returned 0x0 [0100.699] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x70bdea8 | out: ppvObject=0x70bdea8*=0x0) returned 0x80004002 [0100.699] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x62510b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x70bdd9c | out: ppvObject=0x70bdd9c*=0x0) returned 0x80004002 [0100.699] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0100.699] CoGetContextToken (in: pToken=0x70bdd34 | out: pToken=0x70bdd34) returned 0x0 [0100.700] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x624c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70bdd1c | out: ppvObject=0x70bdd1c*=0x6c4204) returned 0x0 [0100.700] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c4204, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x70bdd24 | out: pCid=0x70bdd24*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0100.700] WbemLocator:IUnknown:Release (This=0x6c4204) returned 0x3 [0100.700] CoGetContextToken (in: pToken=0x70bdd2c | out: pToken=0x70bdd2c) returned 0x0 [0100.700] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x4 [0100.700] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x6251767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70bdda0 | out: ppvObject=0x70bdda0*=0x6c428c) returned 0x0 [0100.700] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x4 [0100.700] WbemLocator:IRpcOptions:Query (in: This=0x6c428c, pPrx=0x6c42a4, dwProperty=2, pdwValue=0x70bddc4 | out: pdwValue=0x70bddc4) returned 0x80004002 [0100.700] WbemLocator:IUnknown:Release (This=0x6c428c) returned 0x3 [0100.700] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0100.700] CoGetContextToken (in: pToken=0x70be1a0 | out: pToken=0x70be1a0) returned 0x0 [0100.700] CoGetContextToken (in: pToken=0x70be160 | out: pToken=0x70be160) returned 0x0 [0100.700] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0100.700] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x70be1dc*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x70be1d8 | out: ppvObject=0x70be1d8*=0x7131de4) returned 0x0 [0100.700] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0100.701] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0100.701] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x1 [0100.701] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0100.701] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0100.701] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0100.701] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0100.701] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x2 [0100.701] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0100.701] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0100.701] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x1 [0100.701] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0100.701] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0100.706] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0100.706] CoGetContextToken (in: pToken=0x70be81c | out: pToken=0x70be81c) returned 0x0 [0100.706] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x2 [0100.706] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x70be898*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x70be894 | out: ppvObject=0x70be894*=0x7131de4) returned 0x0 [0100.706] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0100.706] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0100.706] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x7125c48, ppCallResult=0x0) returned 0x0 [0128.704] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0128.705] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0128.705] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0128.705] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.705] IWbemClassObject:Get (in: This=0x7125c48, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c94a08*=0, plFlavor=0x1c94a0c*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="100", varVal2=0x0), pType=0x1c94a08*=21, plFlavor=0x1c94a0c*=0) returned 0x0 [0128.705] SysStringLen (param_1="100") returned 0x3 [0128.705] IWbemClassObject:Get (in: This=0x7125c48, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c94a08*=21, plFlavor=0x1c94a0c*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="100", varVal2=0x0), pType=0x1c94a08*=21, plFlavor=0x1c94a0c*=0) returned 0x0 [0128.705] SysStringLen (param_1="100") returned 0x3 [0129.722] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0129.722] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0129.722] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0129.722] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0129.722] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0129.723] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0129.723] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0129.723] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0129.723] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0129.724] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0129.724] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0129.724] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0129.724] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0129.725] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0129.725] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0129.725] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x7129e18, ppCallResult=0x0) returned 0x0 [0130.034] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0130.034] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0130.035] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0130.035] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0130.035] IWbemClassObject:Get (in: This=0x7129e18, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c9791c*=0, plFlavor=0x1c97920*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1c9791c*=21, plFlavor=0x1c97920*=0) returned 0x0 [0130.035] SysStringLen (param_1="0") returned 0x1 [0130.035] IWbemClassObject:Get (in: This=0x7129e18, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c9791c*=21, plFlavor=0x1c97920*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1c9791c*=21, plFlavor=0x1c97920*=0) returned 0x0 [0130.035] SysStringLen (param_1="0") returned 0x1 [0131.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0131.048] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0131.048] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0131.048] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0131.048] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0131.049] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0131.049] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0131.049] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0131.049] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0131.049] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0131.049] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0131.050] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0131.050] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0131.050] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0131.050] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x7125e00, ppCallResult=0x0) returned 0x0 [0131.353] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0131.353] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0131.353] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0131.354] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0131.354] IWbemClassObject:Get (in: This=0x7125e00, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d22e58*=0, plFlavor=0x1d22e5c*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="5", varVal2=0x0), pType=0x1d22e58*=21, plFlavor=0x1d22e5c*=0) returned 0x0 [0131.354] SysStringLen (param_1="5") returned 0x1 [0131.354] IWbemClassObject:Get (in: This=0x7125e00, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d22e58*=21, plFlavor=0x1d22e5c*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="5", varVal2=0x0), pType=0x1d22e58*=21, plFlavor=0x1d22e5c*=0) returned 0x0 [0131.354] SysStringLen (param_1="5") returned 0x1 [0132.360] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0132.360] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0132.360] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.360] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0132.360] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0132.360] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0132.360] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0132.360] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0132.360] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0132.360] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0132.360] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0132.361] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0132.361] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0132.361] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0132.361] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0132.361] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711f628, ppCallResult=0x0) returned 0x0 [0132.669] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0132.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0132.669] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0132.669] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0132.669] IWbemClassObject:Get (in: This=0x711f628, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d27c60*=0, plFlavor=0x1d27c64*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="11", varVal2=0x0), pType=0x1d27c60*=21, plFlavor=0x1d27c64*=0) returned 0x0 [0132.669] SysStringLen (param_1="11") returned 0x2 [0132.670] IWbemClassObject:Get (in: This=0x711f628, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d27c60*=21, plFlavor=0x1d27c64*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="11", varVal2=0x0), pType=0x1d27c60*=21, plFlavor=0x1d27c64*=0) returned 0x0 [0132.670] SysStringLen (param_1="11") returned 0x2 [0133.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0133.669] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0133.669] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0133.669] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0133.669] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0133.669] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0133.669] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0133.669] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0133.670] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0133.670] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0133.670] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0133.670] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0133.670] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0133.670] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0133.670] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711f7c0, ppCallResult=0x0) returned 0x0 [0133.974] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0133.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0133.974] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0133.974] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0133.975] IWbemClassObject:Get (in: This=0x711f7c0, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2aad8*=0, plFlavor=0x1d2aadc*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1d2aad8*=21, plFlavor=0x1d2aadc*=0) returned 0x0 [0133.975] SysStringLen (param_1="0") returned 0x1 [0133.975] IWbemClassObject:Get (in: This=0x711f7c0, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2aad8*=21, plFlavor=0x1d2aadc*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1d2aad8*=21, plFlavor=0x1d2aadc*=0) returned 0x0 [0133.975] SysStringLen (param_1="0") returned 0x1 [0134.982] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0134.982] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0134.982] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0134.982] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0134.983] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0134.983] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0134.983] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0134.983] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0134.983] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0134.983] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0134.983] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0134.983] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0134.983] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0134.983] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0134.983] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0134.984] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711ca68, ppCallResult=0x0) returned 0x0 [0135.291] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0135.292] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0135.292] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0135.292] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0135.292] IWbemClassObject:Get (in: This=0x711ca68, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2d9e4*=0, plFlavor=0x1d2d9e8*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="23", varVal2=0x0), pType=0x1d2d9e4*=21, plFlavor=0x1d2d9e8*=0) returned 0x0 [0135.292] SysStringLen (param_1="23") returned 0x2 [0135.292] IWbemClassObject:Get (in: This=0x711ca68, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2d9e4*=21, plFlavor=0x1d2d9e8*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="23", varVal2=0x0), pType=0x1d2d9e4*=21, plFlavor=0x1d2d9e8*=0) returned 0x0 [0135.292] SysStringLen (param_1="23") returned 0x2 [0136.305] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0136.305] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0136.305] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.305] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0136.305] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0136.305] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0136.306] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0136.306] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0136.306] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0136.306] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0136.306] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0136.307] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0136.307] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0136.307] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0136.307] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0136.307] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711cc00, ppCallResult=0x0) returned 0x0 [0136.610] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0136.610] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0136.610] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0136.610] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.610] IWbemClassObject:Get (in: This=0x711cc00, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1dd1bac*=0, plFlavor=0x1dd1bb0*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="5", varVal2=0x0), pType=0x1dd1bac*=21, plFlavor=0x1dd1bb0*=0) returned 0x0 [0136.611] SysStringLen (param_1="5") returned 0x1 [0136.611] IWbemClassObject:Get (in: This=0x711cc00, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1dd1bac*=21, plFlavor=0x1dd1bb0*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="5", varVal2=0x0), pType=0x1dd1bac*=21, plFlavor=0x1dd1bb0*=0) returned 0x0 [0136.611] SysStringLen (param_1="5") returned 0x1 [0137.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0137.616] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0137.616] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0137.616] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0137.616] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0137.616] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0137.616] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0137.616] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0137.616] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0137.616] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0137.616] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0137.617] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0137.617] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0137.617] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0137.617] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711cd98, ppCallResult=0x0) returned 0x0 [0137.928] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0137.928] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0137.928] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0137.928] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.929] IWbemClassObject:Get (in: This=0x711cd98, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1dd7050*=0, plFlavor=0x1dd7054*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1dd7050*=21, plFlavor=0x1dd7054*=0) returned 0x0 [0137.929] SysStringLen (param_1="0") returned 0x1 [0137.929] IWbemClassObject:Get (in: This=0x711cd98, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1dd7050*=21, plFlavor=0x1dd7054*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1dd7050*=21, plFlavor=0x1dd7054*=0) returned 0x0 [0137.929] SysStringLen (param_1="0") returned 0x1 [0138.926] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0138.926] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0138.926] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.926] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0138.926] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0138.926] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0138.926] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0138.926] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0138.927] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0138.927] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0138.927] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0138.927] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0138.928] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0138.928] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0138.928] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0138.928] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711cf30, ppCallResult=0x0) returned 0x0 [0139.235] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0139.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0139.235] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0139.235] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0139.235] IWbemClassObject:Get (in: This=0x711cf30, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1dd9eb0*=0, plFlavor=0x1dd9eb4*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1dd9eb0*=21, plFlavor=0x1dd9eb4*=0) returned 0x0 [0139.236] SysStringLen (param_1="0") returned 0x1 [0139.236] IWbemClassObject:Get (in: This=0x711cf30, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1dd9eb0*=21, plFlavor=0x1dd9eb4*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1dd9eb0*=21, plFlavor=0x1dd9eb4*=0) returned 0x0 [0139.236] SysStringLen (param_1="0") returned 0x1 [0140.236] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0140.236] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0140.236] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.236] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0140.237] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0140.237] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0140.237] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0140.237] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0140.237] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0140.237] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0140.238] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0140.238] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0140.238] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0140.238] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0140.238] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0140.238] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711e968, ppCallResult=0x0) returned 0x0 [0140.562] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0140.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0140.562] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0140.562] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.562] IWbemClassObject:Get (in: This=0x711e968, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1dddae4*=0, plFlavor=0x1dddae8*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="11", varVal2=0x0), pType=0x1dddae4*=21, plFlavor=0x1dddae8*=0) returned 0x0 [0140.562] SysStringLen (param_1="11") returned 0x2 [0140.563] IWbemClassObject:Get (in: This=0x711e968, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1dddae4*=21, plFlavor=0x1dddae8*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="11", varVal2=0x0), pType=0x1dddae4*=21, plFlavor=0x1dddae8*=0) returned 0x0 [0140.563] SysStringLen (param_1="11") returned 0x2 [0141.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0141.562] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0141.562] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0141.562] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0141.562] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0141.563] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0141.563] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0141.563] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0141.563] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0141.563] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0141.563] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0141.563] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0141.564] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0141.564] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0141.564] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x7125c48, ppCallResult=0x0) returned 0x0 [0141.876] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0141.876] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0141.876] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0141.876] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.876] IWbemClassObject:Get (in: This=0x7125c48, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c9f6ac*=0, plFlavor=0x1c9f6b0*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="5", varVal2=0x0), pType=0x1c9f6ac*=21, plFlavor=0x1c9f6b0*=0) returned 0x0 [0141.877] SysStringLen (param_1="5") returned 0x1 [0141.877] IWbemClassObject:Get (in: This=0x7125c48, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1c9f6ac*=21, plFlavor=0x1c9f6b0*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="5", varVal2=0x0), pType=0x1c9f6ac*=21, plFlavor=0x1c9f6b0*=0) returned 0x0 [0141.877] SysStringLen (param_1="5") returned 0x1 [0142.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0142.888] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0142.889] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0142.889] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0142.889] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0142.889] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0142.889] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0142.889] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0142.890] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0142.890] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0142.890] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0142.890] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0142.891] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0142.891] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0142.891] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x7129e18, ppCallResult=0x0) returned 0x0 [0143.217] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0143.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0143.217] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0143.217] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0143.217] IWbemClassObject:Get (in: This=0x7129e18, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1ca310c*=0, plFlavor=0x1ca3110*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="11", varVal2=0x0), pType=0x1ca310c*=21, plFlavor=0x1ca3110*=0) returned 0x0 [0143.217] SysStringLen (param_1="11") returned 0x2 [0143.217] IWbemClassObject:Get (in: This=0x7129e18, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1ca310c*=21, plFlavor=0x1ca3110*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="11", varVal2=0x0), pType=0x1ca310c*=21, plFlavor=0x1ca3110*=0) returned 0x0 [0143.217] SysStringLen (param_1="11") returned 0x2 [0144.230] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0144.230] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0144.230] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.230] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0144.230] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0144.230] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0144.230] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0144.230] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0144.231] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0144.231] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0144.231] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0144.231] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0144.231] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0144.232] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0144.232] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0144.232] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x7125e00, ppCallResult=0x0) returned 0x0 [0144.551] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0144.551] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0144.551] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0144.551] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0144.551] IWbemClassObject:Get (in: This=0x7125e00, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1cab5f8*=0, plFlavor=0x1cab5fc*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="16", varVal2=0x0), pType=0x1cab5f8*=21, plFlavor=0x1cab5fc*=0) returned 0x0 [0144.551] SysStringLen (param_1="16") returned 0x2 [0144.552] IWbemClassObject:Get (in: This=0x7125e00, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1cab5f8*=21, plFlavor=0x1cab5fc*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="16", varVal2=0x0), pType=0x1cab5f8*=21, plFlavor=0x1cab5fc*=0) returned 0x0 [0144.552] SysStringLen (param_1="16") returned 0x2 [0145.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0145.558] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0145.558] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0145.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0145.558] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0145.558] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0145.558] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0145.558] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0145.558] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0145.558] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0145.559] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0145.559] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0145.559] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0145.559] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0145.559] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0145.559] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711f628, ppCallResult=0x0) returned 0x0 [0145.861] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0145.861] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0145.861] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0145.861] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0145.861] IWbemClassObject:Get (in: This=0x711f628, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1cae608*=0, plFlavor=0x1cae60c*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1cae608*=21, plFlavor=0x1cae60c*=0) returned 0x0 [0145.861] SysStringLen (param_1="0") returned 0x1 [0145.862] IWbemClassObject:Get (in: This=0x711f628, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1cae608*=21, plFlavor=0x1cae60c*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1cae608*=21, plFlavor=0x1cae60c*=0) returned 0x0 [0145.862] SysStringLen (param_1="0") returned 0x1 [0146.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0146.866] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0146.866] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0146.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0146.866] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0146.866] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0146.866] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0146.866] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0146.866] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0146.866] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0146.866] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0146.867] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0146.867] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0146.867] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0146.867] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0146.867] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711f7c0, ppCallResult=0x0) returned 0x0 [0147.154] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0147.154] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0147.154] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0147.155] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0147.155] IWbemClassObject:Get (in: This=0x711f7c0, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d85d00*=0, plFlavor=0x1d85d04*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1d85d00*=21, plFlavor=0x1d85d04*=0) returned 0x0 [0147.155] SysStringLen (param_1="0") returned 0x1 [0147.155] IWbemClassObject:Get (in: This=0x711f7c0, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d85d00*=21, plFlavor=0x1d85d04*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1d85d00*=21, plFlavor=0x1d85d04*=0) returned 0x0 [0147.155] SysStringLen (param_1="0") returned 0x1 [0148.161] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0148.161] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0148.161] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.161] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0148.162] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0148.162] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0148.162] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0148.162] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0148.162] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0148.162] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0148.162] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0148.162] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0148.162] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0148.162] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0148.162] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0148.162] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711ca68, ppCallResult=0x0) returned 0x0 [0148.473] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0148.473] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0148.473] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0148.473] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0148.473] IWbemClassObject:Get (in: This=0x711ca68, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d88bd0*=0, plFlavor=0x1d88bd4*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1d88bd0*=21, plFlavor=0x1d88bd4*=0) returned 0x0 [0148.473] SysStringLen (param_1="0") returned 0x1 [0148.473] IWbemClassObject:Get (in: This=0x711ca68, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d88bd0*=21, plFlavor=0x1d88bd4*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1d88bd0*=21, plFlavor=0x1d88bd4*=0) returned 0x0 [0148.473] SysStringLen (param_1="0") returned 0x1 [0149.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebb0 | out: puCount=0x70bebb0*=0x2) returned 0x0 [0149.507] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0x0, pszText=0x0 | out: puBuffLength=0x70bebac*=0xf, pszText=0x0) returned 0x0 [0149.507] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131b58, puCount=0x70bec1c | out: puCount=0x70bec1c*=0x0) returned 0x0 [0149.507] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x0, pszText=0x0 | out: puBuffLength=0x70bec18*=0x37, pszText=0x0) returned 0x0 [0149.507] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec18*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec18*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0149.507] CoGetContextToken (in: pToken=0x70beaf4 | out: pToken=0x70beaf4) returned 0x0 [0149.507] WbemLocator:IUnknown:AddRef (This=0x6c42a4) returned 0x3 [0149.507] WbemLocator:IUnknown:QueryInterface (in: This=0x6c42a4, riid=0x625c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x70be718 | out: ppvObject=0x70be718*=0x6c42a4) returned 0x0 [0149.507] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x3 [0149.507] WbemLocator:IUnknown:Release (This=0x6c42a4) returned 0x2 [0149.507] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x0, pszText=0x0 | out: puBuffLength=0x70bec20*=0x37, pszText=0x0) returned 0x0 [0149.507] WbemDefPath:IWbemPath:GetText (in: This=0x7131b58, lFlags=2, puBuffLength=0x70bec20*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x70bec20*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0149.507] CoGetContextToken (in: pToken=0x70be85c | out: pToken=0x70be85c) returned 0x0 [0149.507] WbemLocator:IUnknown:AddRef (This=0x7131de4) returned 0x3 [0149.508] IWbemServices:GetObject (in: This=0x7131de4, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x70be9d0*=0x0, ppCallResult=0x0 | out: ppObject=0x70be9d0*=0x711cc00, ppCallResult=0x0) returned 0x0 [0149.815] WbemLocator:IUnknown:Release (This=0x7131de4) returned 0x2 [0149.815] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x7131c90, puCount=0x70bebe4 | out: puCount=0x70bebe4*=0x2) returned 0x0 [0149.815] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0x0, pszText=0x0 | out: puBuffLength=0x70bebe0*=0xf, pszText=0x0) returned 0x0 [0149.815] WbemDefPath:IWbemPath:GetText (in: This=0x7131c90, lFlags=4, puBuffLength=0x70bebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x70bebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.816] IWbemClassObject:Get (in: This=0x711cc00, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d8cea8*=0, plFlavor=0x1d8ceac*=0 | out: pVal=0x70beba0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1d8cea8*=21, plFlavor=0x1d8ceac*=0) returned 0x0 [0149.816] SysStringLen (param_1="0") returned 0x1 [0149.816] IWbemClassObject:Get (in: This=0x711cc00, wszName="PercentProcessorTime", lFlags=0, pVal=0x70beba4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d8cea8*=21, plFlavor=0x1d8ceac*=0 | out: pVal=0x70beba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0", varVal2=0x0), pType=0x1d8cea8*=21, plFlavor=0x1d8ceac*=0) returned 0x0 [0149.816] SysStringLen (param_1="0") returned 0x1 Thread: id = 232 os_tid = 0x954 Thread: id = 233 os_tid = 0x938 [0100.628] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0103.888] CoUninitialize () Thread: id = 234 os_tid = 0x8b8 [0100.673] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0101.042] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x534 [0101.043] GetLastError () returned 0x0 [0102.140] GetSystemInfo (in: lpSystemInfo=0x7e0e68c | out: lpSystemInfo=0x7e0e68c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4f01)) [0102.140] GetLastError () returned 0x0 [0102.219] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x574 [0102.219] GetLastError () returned 0x0 [0102.526] WSARecv (in: s=0x534, lpBuffers=0x1c4e9e0, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x7e0ee50, lpFlags=0x7e0ee84*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1c4e9e0*=((len=0x2000, buf=0x1c48354)), lpNumberOfBytesRecvd=0x7e0ee50*=0x0, lpFlags=0x7e0ee84*=0x0, lpOverlapped=0x1c4df90) returned -1 [0102.526] GetLastError () returned 0x3e5 Thread: id = 235 os_tid = 0x21c [0100.685] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 236 os_tid = 0x998 [0100.728] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0106.138] send (in: s=0x534, buf=0x1c90974*, len=10, flags=0 | out: buf=0x1c90974*) returned 10 [0106.138] GetLastError () returned 0x0 [0111.580] send (in: s=0x534, buf=0x1d1f89c*, len=10, flags=0 | out: buf=0x1d1f89c*) returned 10 [0111.580] GetLastError () returned 0x0 [0116.588] send (in: s=0x534, buf=0x1d68c6c*, len=10, flags=0 | out: buf=0x1d68c6c*) returned 10 [0116.588] GetLastError () returned 0x0 [0121.621] send (in: s=0x534, buf=0x1c0e8e8*, len=10, flags=0 | out: buf=0x1c0e8e8*) returned 10 [0121.621] GetLastError () returned 0x0 [0126.618] send (in: s=0x534, buf=0x1c8e77c*, len=10, flags=0 | out: buf=0x1c8e77c*) returned 10 [0126.619] GetLastError () returned 0x0 [0131.627] send (in: s=0x534, buf=0x1d23854*, len=10, flags=0 | out: buf=0x1d23854*) returned 10 [0131.633] GetLastError () returned 0x0 [0136.637] send (in: s=0x534, buf=0x1dd2558*, len=10, flags=0 | out: buf=0x1dd2558*) returned 10 [0136.637] GetLastError () returned 0x0 [0141.656] send (in: s=0x534, buf=0x1c9b858*, len=10, flags=0 | out: buf=0x1c9b858*) returned 10 [0141.657] GetLastError () returned 0x0 [0146.681] send (in: s=0x534, buf=0x1d837f8*, len=10, flags=0 | out: buf=0x1d837f8*) returned 10 [0146.681] GetLastError () returned 0x0 Thread: id = 237 os_tid = 0x99c [0102.207] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0102.216] getaddrinfo (in: pNodeName="linkadrum.nl", pServiceName=0x0, pHints=0x80aed10*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x80aeaa4 | out: ppResult=0x80aeaa4*=0x6a168a8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="linkadrum.nl", ai_addr=0x6a16760*(sa_family=2, sin_port=0x0, sin_addr="147.135.136.193"), ai_next=0x0)) returned 0 [0102.459] GetLastError () returned 0x0 [0102.460] FreeAddrInfoW (pAddrInfo=0x6a168a8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="楬歮摡畲⹭汮 u栛㰹덌ఀ\x01", ai_addr=0x6a16760*(sa_family=2, sin_port=0x0, sin_addr="147.135.136.193"), ai_next=0x0)) [0102.460] GetLastError () returned 0x0 [0102.464] bind (s=0x534, addr=0x1c4de58*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0102.464] GetLastError () returned 0x0 [0102.475] WSAIoctl (in: s=0x534, dwIoControlCode=0xc8000006, lpvInBuffer=0x80aebd8, cbInBuffer=0x10, lpvOutBuffer=0x80aebec, cbOutBuffer=0x4, lpcbBytesReturned=0x80aebe8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x80aebec, lpcbBytesReturned=0x80aebe8, lpOverlapped=0x0) returned 0 [0102.475] GetLastError () returned 0x0 Thread: id = 238 os_tid = 0xa84 Thread: id = 239 os_tid = 0xa8c [0102.517] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0102.523] setsockopt (s=0x534, level=65535, optname=28688, optval=0x0, optlen=0) returned 0 [0102.523] GetLastError () returned 0x0 [0102.524] SetEvent (hEvent=0x574) returned 1 [0102.553] GetLastError () returned 0x0 [0104.379] send (in: s=0x534, buf=0x1c52dd8*, len=50, flags=0 | out: buf=0x1c52dd8*) returned 50 [0104.379] GetLastError () returned 0x0 [0104.508] GetLastInputInfo (in: plii=0x843ec08 | out: plii=0x843ec08) returned 1 [0104.583] GlobalMemoryStatusEx (in: lpBuffer=0x1c60e44 | out: lpBuffer=0x1c60e44) returned 1 [0104.584] GetLastError () returned 0x0 [0104.584] GlobalMemoryStatusEx (in: lpBuffer=0x1c60e44 | out: lpBuffer=0x1c60e44) returned 1 [0104.584] GetLastError () returned 0x0 [0104.584] GlobalMemoryStatusEx (in: lpBuffer=0x1c60e44 | out: lpBuffer=0x1c60e44) returned 1 [0104.584] GetLastError () returned 0x0 [0104.616] send (in: s=0x534, buf=0x1c6a9d8*, len=257, flags=0 | out: buf=0x1c6a9d8*) returned 257 [0104.617] GetLastError () returned 0x0 [0104.648] send (in: s=0x534, buf=0x1c6c540*, len=10, flags=0 | out: buf=0x1c6c540*) returned 10 [0104.648] GetLastError () returned 0x0 [0104.699] WSARecv (in: s=0x534, lpBuffers=0x1c6ddb8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x843edd8, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1c6ddb8*=((len=0x1fd0, buf=0x1c48384)), lpNumberOfBytesRecvd=0x843edd8*=0x0, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0104.699] GetLastError () returned 0x3e5 [0106.386] send (in: s=0x534, buf=0x1c92864*, len=10, flags=0 | out: buf=0x1c92864*) returned 10 [0106.386] GetLastError () returned 0x0 [0106.387] WSARecv (in: s=0x534, lpBuffers=0x1c93cd0, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x843edd8, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1c93cd0*=((len=0x1fc6, buf=0x1c4838e)), lpNumberOfBytesRecvd=0x843edd8*=0x0, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0106.387] GetLastError () returned 0x3e5 [0106.562] WSARecv (in: s=0x534, lpBuffers=0x1c93ff4, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x843edd8, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1c93ff4*=((len=0x1fbc, buf=0x1c48398)), lpNumberOfBytesRecvd=0x843edd8*=0x0, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0106.562] GetLastError () returned 0x3e5 [0111.610] WSARecv (in: s=0x534, lpBuffers=0x1d20f28, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x843edd8, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1d20f28*=((len=0x1fb2, buf=0x1c483a2)), lpNumberOfBytesRecvd=0x843edd8*=0x0, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0111.611] GetLastError () returned 0x3e5 [0116.619] WSARecv (in: s=0x534, lpBuffers=0x1d6a2f8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x843edd8, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1d6a2f8*=((len=0x1fa8, buf=0x1c483ac)), lpNumberOfBytesRecvd=0x843edd8*=0x0, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0116.620] GetLastError () returned 0x3e5 [0121.651] WSARecv (in: s=0x534, lpBuffers=0x1c12678, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x843edd8, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1c12678*=((len=0x1f9e, buf=0x1c483b6)), lpNumberOfBytesRecvd=0x843edd8*=0x0, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0121.651] GetLastError () returned 0x3e5 [0126.649] WSARecv (in: s=0x534, lpBuffers=0x1c8fe08, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x843edd8, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1c8fe08*=((len=0x1f94, buf=0x1c483c0)), lpNumberOfBytesRecvd=0x843edd8*=0x0, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0126.650] GetLastError () returned 0x3e5 [0131.668] WSARecv (in: s=0x534, lpBuffers=0x1d254d4, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x843edd8, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1d254d4*=((len=0x1f8a, buf=0x1c483ca)), lpNumberOfBytesRecvd=0x843edd8*=0x0, lpFlags=0x843ee0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0131.668] GetLastError () returned 0x3e5 [0146.664] CoUninitialize () [0146.664] CoGetContextToken (in: pToken=0x843f254 | out: pToken=0x843f254) returned 0x0 [0146.664] IUnknown:QueryInterface (in: This=0x648630, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x843f288 | out: ppvObject=0x843f288*=0x64863c) returned 0x0 [0146.664] IComThreadingInfo:GetCurrentThreadType (in: This=0x64863c, pThreadType=0x843f2bc | out: pThreadType=0x843f2bc*=0) returned 0x0 [0146.665] IUnknown:Release (This=0x64863c) returned 0x1 [0146.665] CoGetContextToken (in: pToken=0x843f1e8 | out: pToken=0x843f1e8) returned 0x0 [0146.665] IUnknown:QueryInterface (in: This=0x648630, riid=0x625e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x843f21c | out: ppvObject=0x843f21c*=0x64863c) returned 0x0 [0146.665] IComThreadingInfo:GetCurrentThreadType (in: This=0x64863c, pThreadType=0x843f250 | out: pThreadType=0x843f250*=0) returned 0x0 [0146.665] IUnknown:Release (This=0x64863c) returned 0x1 Thread: id = 240 os_tid = 0xa7c [0103.727] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0103.762] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\", nBufferLength=0x105, lpBuffer=0x868ea90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\", lpFilePart=0x0) returned 0x34 [0103.762] GetLastError () returned 0x0 [0103.762] SetErrorMode (uMode=0x1) returned 0x0 [0103.762] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\monitoring"), fInfoLevelId=0x0, lpFileInformation=0x868ef10 | out: lpFileInformation=0x868ef10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.763] GetLastError () returned 0x2 [0103.763] SetErrorMode (uMode=0x0) returned 0x1 [0103.763] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\", nBufferLength=0x105, lpBuffer=0x868ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\", lpFilePart=0x0) returned 0x34 [0103.763] GetLastError () returned 0x2 [0103.763] SetErrorMode (uMode=0x1) returned 0x0 [0103.763] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\monitoring"), fInfoLevelId=0x0, lpFileInformation=0x868eeb8 | out: lpFileInformation=0x868eeb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.763] GetLastError () returned 0x2 [0103.763] SetErrorMode (uMode=0x0) returned 0x1 [0103.763] SetErrorMode (uMode=0x1) returned 0x0 [0103.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent"), fInfoLevelId=0x0, lpFileInformation=0x868eeb8 | out: lpFileInformation=0x868eeb8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29127270, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x29127270, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x29127270, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0103.795] GetLastError () returned 0x2 [0103.795] SetErrorMode (uMode=0x0) returned 0x1 [0103.796] SetErrorMode (uMode=0x1) returned 0x0 [0103.796] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming" (normalized: "c:\\users\\jpenum\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x868eeb8 | out: lpFileInformation=0x868eeb8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x162a7ec0, ftCreationTime.dwHighDateTime=0x1d33edb, ftLastAccessTime.dwLowDateTime=0x29127270, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x29127270, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0103.796] GetLastError () returned 0x2 [0103.796] SetErrorMode (uMode=0x0) returned 0x1 [0103.796] SetErrorMode (uMode=0x1) returned 0x0 [0103.796] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData" (normalized: "c:\\users\\jpenum\\appdata"), fInfoLevelId=0x0, lpFileInformation=0x868eeb8 | out: lpFileInformation=0x868eeb8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x162a7ec0, ftCreationTime.dwHighDateTime=0x1d33edb, ftLastAccessTime.dwLowDateTime=0x162ce020, ftLastAccessTime.dwHighDateTime=0x1d33edb, ftLastWriteTime.dwLowDateTime=0x7b4de3da, ftLastWriteTime.dwHighDateTime=0x1cb88f5, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0103.796] GetLastError () returned 0x2 [0103.796] SetErrorMode (uMode=0x0) returned 0x1 [0103.796] SetErrorMode (uMode=0x1) returned 0x0 [0103.796] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM" (normalized: "c:\\users\\jpenum"), fInfoLevelId=0x0, lpFileInformation=0x868eeb8 | out: lpFileInformation=0x868eeb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16235aa0, ftCreationTime.dwHighDateTime=0x1d33edb, ftLastAccessTime.dwLowDateTime=0x167b6d80, ftLastAccessTime.dwHighDateTime=0x1d33edb, ftLastWriteTime.dwLowDateTime=0x167b6d80, ftLastWriteTime.dwHighDateTime=0x1d33edb, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0103.796] GetLastError () returned 0x2 [0103.796] SetErrorMode (uMode=0x0) returned 0x1 [0103.796] SetErrorMode (uMode=0x1) returned 0x0 [0103.796] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x868eeb8 | out: lpFileInformation=0x868eeb8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfa01468f, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x16235aa0, ftLastAccessTime.dwHighDateTime=0x1d33edb, ftLastWriteTime.dwLowDateTime=0x16235aa0, ftLastWriteTime.dwHighDateTime=0x1d33edb, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0103.796] GetLastError () returned 0x2 [0103.796] SetErrorMode (uMode=0x0) returned 0x1 [0103.796] CreateDirectoryW (lpPathName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\monitoring"), lpSecurityAttributes=0x0) returned 1 [0103.797] GetLastError () returned 0x2 [0104.257] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat", nBufferLength=0x105, lpBuffer=0x868ea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat", lpFilePart=0x0) returned 0x3f [0104.257] GetLastError () returned 0x2 [0104.257] SetErrorMode (uMode=0x1) returned 0x0 [0104.258] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\monitoring\\network.dat"), fInfoLevelId=0x0, lpFileInformation=0x868ee80 | out: lpFileInformation=0x868ee80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.258] GetLastError () returned 0x2 [0104.258] SetErrorMode (uMode=0x0) returned 0x1 [0104.258] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat", nBufferLength=0x105, lpBuffer=0x868e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat", lpFilePart=0x0) returned 0x3f [0104.258] GetLastError () returned 0x2 [0104.258] SetErrorMode (uMode=0x1) returned 0x0 [0104.258] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\monitoring\\network.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5c0 [0104.259] GetLastError () returned 0x0 [0104.259] GetFileType (hFile=0x5c0) returned 0x1 [0104.259] SetErrorMode (uMode=0x0) returned 0x1 [0104.259] GetFileType (hFile=0x5c0) returned 0x1 [0104.259] WriteFile (in: hFile=0x5c0, lpBuffer=0x1c5a6b4*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x868ee10, lpOverlapped=0x0 | out: lpBuffer=0x1c5a6b4*, lpNumberOfBytesWritten=0x868ee10*=0x1b, lpOverlapped=0x0) returned 1 [0104.260] GetLastError () returned 0x0 [0104.260] CloseHandle (hObject=0x5c0) returned 1 [0104.261] GetLastError () returned 0x0 Thread: id = 241 os_tid = 0xa88 [0103.842] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0103.864] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\", nBufferLength=0x105, lpBuffer=0x887e780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\", lpFilePart=0x0) returned 0x34 [0103.864] GetLastError () returned 0x0 [0103.864] SetErrorMode (uMode=0x1) returned 0x0 [0103.864] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\monitoring"), fInfoLevelId=0x0, lpFileInformation=0x887ec00 | out: lpFileInformation=0x887ec00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b208250, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x2b208250, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x2b208250, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0103.864] GetLastError () returned 0x0 [0103.864] SetErrorMode (uMode=0x0) returned 0x1 [0104.189] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat", nBufferLength=0x105, lpBuffer=0x887e718, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat", lpFilePart=0x0) returned 0x3e [0104.189] GetLastError () returned 0x0 [0104.189] SetErrorMode (uMode=0x1) returned 0x0 [0104.189] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\monitoring\\system.dat"), fInfoLevelId=0x0, lpFileInformation=0x887eb98 | out: lpFileInformation=0x887eb98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.189] GetLastError () returned 0x2 [0104.189] SetErrorMode (uMode=0x0) returned 0x1 [0104.214] GlobalMemoryStatusEx (in: lpBuffer=0x1c58490 | out: lpBuffer=0x1c58490) returned 1 [0104.214] GetLastError () returned 0x2 [0104.214] GlobalMemoryStatusEx (in: lpBuffer=0x1c58490 | out: lpBuffer=0x1c58490) returned 1 [0104.214] GetLastError () returned 0x2 [0104.214] GlobalMemoryStatusEx (in: lpBuffer=0x1c58490 | out: lpBuffer=0x1c58490) returned 1 [0104.214] GetLastError () returned 0x2 [0104.307] GlobalMemoryStatusEx (in: lpBuffer=0x1c58490 | out: lpBuffer=0x1c58490) returned 1 [0104.307] GetLastError () returned 0x2 [0104.307] GlobalMemoryStatusEx (in: lpBuffer=0x1c58490 | out: lpBuffer=0x1c58490) returned 1 [0104.307] GetLastError () returned 0x2 [0104.307] GlobalMemoryStatusEx (in: lpBuffer=0x1c58490 | out: lpBuffer=0x1c58490) returned 1 [0104.307] GetLastError () returned 0x2 [0104.308] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat", nBufferLength=0x105, lpBuffer=0x887e600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat", lpFilePart=0x0) returned 0x3e [0104.308] GetLastError () returned 0x2 [0104.308] SetErrorMode (uMode=0x1) returned 0x0 [0104.308] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\monitoring\\system.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5c0 [0104.308] GetLastError () returned 0x0 [0104.308] GetFileType (hFile=0x5c0) returned 0x1 [0104.308] SetErrorMode (uMode=0x0) returned 0x1 [0104.308] GetFileType (hFile=0x5c0) returned 0x1 [0104.308] WriteFile (in: hFile=0x5c0, lpBuffer=0x1c5ea08*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x887eb28, lpOverlapped=0x0 | out: lpBuffer=0x1c5ea08*, lpNumberOfBytesWritten=0x887eb28*=0x12, lpOverlapped=0x0) returned 1 [0104.312] GetLastError () returned 0x0 [0104.313] CloseHandle (hObject=0x5c0) returned 1 [0104.314] GetLastError () returned 0x0 Thread: id = 244 os_tid = 0xa9c [0104.668] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0104.885] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x6eebc0 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0104.886] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x7b2e2ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0104.886] GetLastError () returned 0x3f0 [0104.886] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat", nBufferLength=0x105, lpBuffer=0x7b2e364, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat", lpFilePart=0x0) returned 0x30 [0104.886] GetLastError () returned 0x3f0 [0104.886] SetErrorMode (uMode=0x1) returned 0x0 [0104.886] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\geo.dat"), fInfoLevelId=0x0, lpFileInformation=0x7b2e7e4 | out: lpFileInformation=0x7b2e7e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.886] GetLastError () returned 0x2 [0104.886] SetErrorMode (uMode=0x0) returned 0x1 [0105.136] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5d4 [0105.136] GetLastError () returned 0x0 [0105.136] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5d8 [0105.136] GetLastError () returned 0x0 [0105.199] GetCurrentProcess () returned 0xffffffff [0105.199] GetLastError () returned 0x3f0 [0105.199] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e370 | out: TokenHandle=0x7b2e370*=0x5dc) returned 1 [0105.199] GetLastError () returned 0x3f0 [0105.202] GetCurrentProcess () returned 0xffffffff [0105.202] GetLastError () returned 0x3f0 [0105.202] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e380 | out: TokenHandle=0x7b2e380*=0x5e0) returned 1 [0105.202] GetLastError () returned 0x3f0 [0105.209] GetCurrentProcess () returned 0xffffffff [0105.209] GetLastError () returned 0x3f0 [0105.209] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e344 | out: TokenHandle=0x7b2e344*=0x5e4) returned 1 [0105.209] GetLastError () returned 0x3f0 [0105.211] GetCurrentProcess () returned 0xffffffff [0105.211] GetLastError () returned 0x3f0 [0105.211] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e354 | out: TokenHandle=0x7b2e354*=0x5e8) returned 1 [0105.211] GetLastError () returned 0x3f0 [0105.214] GetCurrentProcess () returned 0xffffffff [0105.214] GetLastError () returned 0x3f0 [0105.215] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e648 | out: TokenHandle=0x7b2e648*=0x5ec) returned 1 [0105.215] GetLastError () returned 0x3f0 [0105.267] RasEnumConnectionsW (in: param_1=0x703400, param_2=0x7b2e6c0, param_3=0x7b2e6c4 | out: param_1=0x703400, param_2=0x7b2e6c0, param_3=0x7b2e6c4) returned 0x0 [0105.273] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x624 [0105.273] GetLastError () returned 0x0 [0105.273] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x628 [0105.274] GetLastError () returned 0x0 [0105.275] ioctlsocket (in: s=0x624, cmd=-2147195266, argp=0x7b2e6c8 | out: argp=0x7b2e6c8) returned 0 [0105.275] GetLastError () returned 0x0 [0105.275] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x62c [0105.275] GetLastError () returned 0x0 [0105.275] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x630 [0105.275] GetLastError () returned 0x0 [0105.275] ioctlsocket (in: s=0x62c, cmd=-2147195266, argp=0x7b2e6c8 | out: argp=0x7b2e6c8) returned 0 [0105.275] GetLastError () returned 0x0 [0105.276] WSAIoctl (in: s=0x624, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x7b2e6ac, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x7b2e6ac, lpOverlapped=0x0) returned -1 [0105.276] GetLastError () returned 0x2733 [0105.278] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x703400, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0105.307] GetLastError () returned 0x2733 [0105.308] WSAEventSelect (s=0x624, hEventObject=0x628, lNetworkEvents=512) returned 0 [0105.308] GetLastError () returned 0x0 [0105.308] WSAIoctl (in: s=0x62c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x7b2e6ac, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x7b2e6ac, lpOverlapped=0x0) returned -1 [0105.308] GetLastError () returned 0x2733 [0105.308] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x703400, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0105.308] GetLastError () returned 0x2733 [0105.310] WSAEventSelect (s=0x62c, hEventObject=0x630, lNetworkEvents=512) returned 0 [0105.310] GetLastError () returned 0x0 [0105.310] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x634 [0105.310] GetLastError () returned 0x0 [0105.311] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x634, param_3=0x3) returned 0x0 [0105.317] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x7b2e690 | out: phkResult=0x7b2e690*=0x64c) returned 0x0 [0105.318] GetLastError () returned 0x0 [0105.320] RegOpenKeyExW (in: hKey=0x64c, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x7b2e64c | out: phkResult=0x7b2e64c*=0x650) returned 0x0 [0105.320] GetLastError () returned 0x0 [0105.320] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x654 [0105.320] GetLastError () returned 0x0 [0105.321] RegNotifyChangeKeyValue (hKey=0x650, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x654, fAsynchronous=1) returned 0x0 [0105.321] GetLastError () returned 0x0 [0105.322] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x7b2e64c | out: phkResult=0x7b2e64c*=0x658) returned 0x0 [0105.322] GetLastError () returned 0x0 [0105.322] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x65c [0105.322] GetLastError () returned 0x0 [0105.323] RegNotifyChangeKeyValue (hKey=0x658, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x65c, fAsynchronous=1) returned 0x0 [0105.323] GetLastError () returned 0x0 [0105.323] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x7b2e64c | out: phkResult=0x7b2e64c*=0x660) returned 0x0 [0105.323] GetLastError () returned 0x0 [0105.323] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x664 [0105.323] GetLastError () returned 0x0 [0105.323] RegNotifyChangeKeyValue (hKey=0x660, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x664, fAsynchronous=1) returned 0x0 [0105.323] GetLastError () returned 0x0 [0105.327] GetCurrentProcess () returned 0xffffffff [0105.327] GetLastError () returned 0x3f0 [0105.327] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e634 | out: TokenHandle=0x7b2e634*=0x678) returned 1 [0105.327] GetLastError () returned 0x3f0 [0105.331] GetCurrentProcess () returned 0xffffffff [0105.331] GetLastError () returned 0x3f0 [0105.331] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e250 | out: TokenHandle=0x7b2e250*=0x67c) returned 1 [0105.331] GetLastError () returned 0x3f0 [0105.333] GetCurrentProcess () returned 0xffffffff [0105.333] GetLastError () returned 0x3f0 [0105.333] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e260 | out: TokenHandle=0x7b2e260*=0x680) returned 1 [0105.333] GetLastError () returned 0x3f0 [0105.351] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x694bd0 | out: pProxyConfig=0x694bd0) returned 1 [0105.397] GetLastError () returned 0x0 [0105.411] GetCurrentProcess () returned 0xffffffff [0105.411] GetLastError () returned 0x3f0 [0105.411] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e2c8 | out: TokenHandle=0x7b2e2c8*=0x694) returned 1 [0105.411] GetLastError () returned 0x3f0 [0105.412] GetCurrentProcess () returned 0xffffffff [0105.412] GetLastError () returned 0x3f0 [0105.412] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e2d8 | out: TokenHandle=0x7b2e2d8*=0x690) returned 1 [0105.412] GetLastError () returned 0x3f0 [0105.413] SetEvent (hEvent=0x5d4) returned 1 [0105.413] GetLastError () returned 0x3f0 [0105.423] SetEvent (hEvent=0x5d4) returned 1 [0105.423] GetLastError () returned 0x0 [0105.424] GetACP () returned 0x4e4 [0105.440] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6bc [0105.440] GetLastError () returned 0x0 [0105.440] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6c0 [0105.441] GetLastError () returned 0x0 [0105.441] getaddrinfo (in: pNodeName="www.iptrackeronline.com", pServiceName=0x0, pHints=0x7b2e4e8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x7b2e27c | out: ppResult=0x7b2e27c*=0x6a169d8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="iptrackeronline.com", ai_addr=0x6a16610*(sa_family=2, sin_port=0x0, sin_addr="45.55.57.244"), ai_next=0x0)) returned 0 [0105.461] GetLastError () returned 0x0 [0105.461] FreeAddrInfoW (pAddrInfo=0x6a169d8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="灩牴捡敫潲汮湩⹥潣mࡨڡ梩輸덋", ai_addr=0x6a16610*(sa_family=2, sin_port=0x0, sin_addr="45.55.57.244"), ai_next=0x0)) [0105.461] GetLastError () returned 0x0 [0105.462] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6c8 [0105.462] GetLastError () returned 0x0 [0105.462] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6cc [0105.462] GetLastError () returned 0x0 [0105.462] ioctlsocket (in: s=0x6c8, cmd=-2147195266, argp=0x7b2e4cc | out: argp=0x7b2e4cc) returned 0 [0105.462] GetLastError () returned 0x0 [0105.462] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6d0 [0105.462] GetLastError () returned 0x0 [0105.463] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6d4 [0105.463] GetLastError () returned 0x0 [0105.463] ioctlsocket (in: s=0x6d0, cmd=-2147195266, argp=0x7b2e4cc | out: argp=0x7b2e4cc) returned 0 [0105.463] GetLastError () returned 0x0 [0105.463] WSAIoctl (in: s=0x6c8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x7b2e4b0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x7b2e4b0, lpOverlapped=0x0) returned -1 [0105.463] GetLastError () returned 0x2733 [0105.463] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x703400, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0105.463] GetLastError () returned 0x2733 [0105.463] WSAEventSelect (s=0x6c8, hEventObject=0x6cc, lNetworkEvents=512) returned 0 [0105.463] GetLastError () returned 0x0 [0105.463] WSAIoctl (in: s=0x6d0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x7b2e4b0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x7b2e4b0, lpOverlapped=0x0) returned -1 [0105.463] GetLastError () returned 0x2733 [0105.463] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x703400, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0105.463] GetLastError () returned 0x2733 [0105.463] WSAEventSelect (s=0x6d0, hEventObject=0x6d4, lNetworkEvents=512) returned 0 [0105.463] GetLastError () returned 0x0 [0105.463] GetAdaptersAddresses () returned 0x6f [0105.468] LocalAlloc (uFlags=0x0, uBytes=0x7dc) returned 0x70ea28 [0105.468] GetLastError () returned 0x0 [0105.468] GetAdaptersAddresses () returned 0x0 [0105.473] LocalFree (hMem=0x70ea28) returned 0x0 [0105.473] GetLastError () returned 0x0 [0105.475] WSAConnect (in: s=0x6bc, name=0x1c7cb54*(sa_family=2, sin_port=0x1bb, sin_addr="45.55.57.244"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0105.566] GetLastError () returned 0x0 [0105.567] closesocket (s=0x6c0) returned 0 [0105.567] GetLastError () returned 0x0 [0105.584] EnumerateSecurityPackagesW (in: pcPackages=0x7b2e454, ppPackageInfo=0x7b2e3c4 | out: pcPackages=0x7b2e454, ppPackageInfo=0x7b2e3c4) returned 0x0 [0105.584] GetLastError () returned 0x0 [0105.586] lstrlenW (lpString="Negotiate") returned 9 [0105.587] RtlMoveMemory (in: Destination=0x703400, Source=0x6f76a8, Length=0x14 | out: Destination=0x703400) [0105.587] lstrlenW (lpString="Microsoft Package Negotiator") returned 28 [0105.587] RtlMoveMemory (in: Destination=0x703400, Source=0x6f76bc, Length=0x3a | out: Destination=0x703400) [0105.587] lstrlenW (lpString="NegoExtender") returned 12 [0105.587] RtlMoveMemory (in: Destination=0x703400, Source=0x6f76f6, Length=0x1a | out: Destination=0x703400) [0105.588] lstrlenW (lpString="NegoExtender Security Package") returned 29 [0105.588] RtlMoveMemory (in: Destination=0x703400, Source=0x6f7710, Length=0x3c | out: Destination=0x703400) [0105.588] lstrlenW (lpString="Kerberos") returned 8 [0105.588] RtlMoveMemory (in: Destination=0x703400, Source=0x6f774c, Length=0x12 | out: Destination=0x703400) [0105.588] lstrlenW (lpString="Microsoft Kerberos V1.0") returned 23 [0105.588] RtlMoveMemory (in: Destination=0x703400, Source=0x6f775e, Length=0x30 | out: Destination=0x703400) [0105.588] lstrlenW (lpString="NTLM") returned 4 [0105.588] RtlMoveMemory (in: Destination=0x703400, Source=0x6f778e, Length=0xa | out: Destination=0x703400) [0105.588] lstrlenW (lpString="NTLM Security Package") returned 21 [0105.588] RtlMoveMemory (in: Destination=0x703400, Source=0x6f7798, Length=0x2c | out: Destination=0x703400) [0105.588] lstrlenW (lpString="Schannel") returned 8 [0105.588] RtlMoveMemory (in: Destination=0x703400, Source=0x6f77c4, Length=0x12 | out: Destination=0x703400) [0105.588] lstrlenW (lpString="Schannel Security Package") returned 25 [0105.588] RtlMoveMemory (in: Destination=0x703400, Source=0x6f77d6, Length=0x34 | out: Destination=0x703400) [0105.589] lstrlenW (lpString="Microsoft Unified Security Protocol Provider") returned 44 [0105.589] RtlMoveMemory (in: Destination=0x703400, Source=0x6f780a, Length=0x5a | out: Destination=0x703400) [0105.589] lstrlenW (lpString="Schannel Security Package") returned 25 [0105.589] RtlMoveMemory (in: Destination=0x703400, Source=0x6f7864, Length=0x34 | out: Destination=0x703400) [0105.589] lstrlenW (lpString="WDigest") returned 7 [0105.589] RtlMoveMemory (in: Destination=0x703400, Source=0x6f7898, Length=0x10 | out: Destination=0x703400) [0105.589] lstrlenW (lpString="Digest Authentication for Windows") returned 33 [0105.589] RtlMoveMemory (in: Destination=0x703400, Source=0x6f78a8, Length=0x44 | out: Destination=0x703400) [0105.589] lstrlenW (lpString="TSSSP") returned 5 [0105.589] RtlMoveMemory (in: Destination=0x703400, Source=0x6f78ec, Length=0xc | out: Destination=0x703400) [0105.589] lstrlenW (lpString="TS Service Security Package") returned 27 [0105.589] RtlMoveMemory (in: Destination=0x703400, Source=0x6f78f8, Length=0x38 | out: Destination=0x703400) [0105.590] lstrlenW (lpString="pku2u") returned 5 [0105.590] RtlMoveMemory (in: Destination=0x703400, Source=0x6f7930, Length=0xc | out: Destination=0x703400) [0105.590] lstrlenW (lpString="PKU2U Security Package") returned 22 [0105.590] RtlMoveMemory (in: Destination=0x703400, Source=0x6f793c, Length=0x2e | out: Destination=0x703400) [0105.590] lstrlenW (lpString="CREDSSP") returned 7 [0105.590] RtlMoveMemory (in: Destination=0x703400, Source=0x6f796a, Length=0x10 | out: Destination=0x703400) [0105.590] lstrlenW (lpString="Microsoft CredSSP Security Provider") returned 35 [0105.590] RtlMoveMemory (in: Destination=0x703400, Source=0x6f797a, Length=0x48 | out: Destination=0x703400) [0105.590] FreeContextBuffer (in: pvContextBuffer=0x6f75e0 | out: pvContextBuffer=0x6f75e0) returned 0x0 [0105.590] GetLastError () returned 0x7f [0105.595] GetCurrentProcess () returned 0xffffffff [0105.595] GetLastError () returned 0x3f0 [0105.595] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7b2e21c | out: TokenHandle=0x7b2e21c*=0x6c0) returned 1 [0105.595] GetLastError () returned 0x3f0 [0105.598] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x1c8b218, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x7b2e2b8, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x1c8ca80, ptsExpiry=0x7b2e224 | out: phCredential=0x1c8ca80, ptsExpiry=0x7b2e224) returned 0x0 [0105.600] GetLastError () returned 0x0 [0105.603] InitializeSecurityContextW (in: phCredential=0x7b2e220, phContext=0x0, pTargetName=0x1c77944, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x1c8ccb0, pOutput=0x1c8cc48, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2e218 | out: phNewContext=0x1c8ccb0, pOutput=0x1c8cc48, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2e218) returned 0x90312 [0105.603] GetLastError () returned 0x0 [0105.604] FreeContextBuffer (in: pvContextBuffer=0x6aeae8 | out: pvContextBuffer=0x6aeae8) returned 0x0 [0105.604] GetLastError () returned 0x0 [0105.613] send (in: s=0x6bc, buf=0x1c8ccc4*, len=127, flags=0 | out: buf=0x1c8ccc4*) returned 127 [0105.613] GetLastError () returned 0x0 [0105.613] recv (in: s=0x6bc, buf=0x1c8ccc4, len=5, flags=0 | out: buf=0x1c8ccc4*) returned 5 [0105.705] GetLastError () returned 0x0 [0105.705] recv (in: s=0x6bc, buf=0x1c8ccc9, len=93, flags=0 | out: buf=0x1c8ccc9*) returned 93 [0105.705] GetLastError () returned 0x0 [0105.706] InitializeSecurityContextW (in: phCredential=0x7b2e160, phContext=0x7b2e274, pTargetName=0x1c77944, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x1c8db2c, Reserved2=0x0, phNewContext=0x1c8ccb0, pOutput=0x1c8db40, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2e158 | out: phNewContext=0x1c8ccb0, pOutput=0x1c8db40, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2e158) returned 0x90312 [0105.706] GetLastError () returned 0x0 [0105.706] recv (in: s=0x6bc, buf=0x1c8dbd0, len=5, flags=0 | out: buf=0x1c8dbd0*) returned 5 [0105.706] GetLastError () returned 0x0 [0105.706] recv (in: s=0x6bc, buf=0x1c8dbe9, len=2615, flags=0 | out: buf=0x1c8dbe9*) returned 2615 [0105.706] GetLastError () returned 0x0 [0105.707] InitializeSecurityContextW (in: phCredential=0x7b2e0a8, phContext=0x7b2e1bc, pTargetName=0x1c77944, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x1c8e694, Reserved2=0x0, phNewContext=0x1c8ccb0, pOutput=0x1c8e6a8, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2e0a0 | out: phNewContext=0x1c8ccb0, pOutput=0x1c8e6a8, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2e0a0) returned 0x90312 [0105.707] GetLastError () returned 0x0 [0105.707] recv (in: s=0x6bc, buf=0x1c8e738, len=5, flags=0 | out: buf=0x1c8e738*) returned 5 [0105.707] GetLastError () returned 0x0 [0105.707] recv (in: s=0x6bc, buf=0x1c8e751, len=331, flags=0 | out: buf=0x1c8e751*) returned 331 [0105.707] GetLastError () returned 0x0 [0105.707] InitializeSecurityContextW (in: phCredential=0x7b2dff0, phContext=0x7b2e104, pTargetName=0x1c77944, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x1c8e910, Reserved2=0x0, phNewContext=0x1c8ccb0, pOutput=0x1c8e924, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2dfe8 | out: phNewContext=0x1c8ccb0, pOutput=0x1c8e924, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2dfe8) returned 0x90312 [0105.707] GetLastError () returned 0x0 [0105.707] recv (in: s=0x6bc, buf=0x1c8e9b4, len=5, flags=0 | out: buf=0x1c8e9b4*) returned 5 [0105.707] GetLastError () returned 0x0 [0105.707] recv (in: s=0x6bc, buf=0x1c8e9cd, len=4, flags=0 | out: buf=0x1c8e9cd*) returned 4 [0105.707] GetLastError () returned 0x0 [0105.708] InitializeSecurityContextW (in: phCredential=0x7b2df38, phContext=0x7b2e04c, pTargetName=0x1c77944, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x1c8ea48, Reserved2=0x0, phNewContext=0x1c8ccb0, pOutput=0x1c8ea5c, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2df30 | out: phNewContext=0x1c8ccb0, pOutput=0x1c8ea5c, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2df30) returned 0x90312 [0105.719] GetLastError () returned 0x0 [0105.719] FreeContextBuffer (in: pvContextBuffer=0x66f4a0 | out: pvContextBuffer=0x66f4a0) returned 0x0 [0105.719] GetLastError () returned 0x0 [0105.720] send (in: s=0x6bc, buf=0x1c8ead8*, len=134, flags=0 | out: buf=0x1c8ead8*) returned 134 [0105.720] GetLastError () returned 0x0 [0105.720] recv (in: s=0x6bc, buf=0x1c8ead8, len=5, flags=0 | out: buf=0x1c8ead8*) returned 5 [0105.810] GetLastError () returned 0x0 [0105.810] recv (in: s=0x6bc, buf=0x1c8eadd, len=1, flags=0 | out: buf=0x1c8eadd*) returned 1 [0105.810] GetLastError () returned 0x0 [0105.811] InitializeSecurityContextW (in: phCredential=0x7b2de80, phContext=0x7b2df94, pTargetName=0x1c77944, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x1c8ebe8, Reserved2=0x0, phNewContext=0x1c8ccb0, pOutput=0x1c8ebfc, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2de78 | out: phNewContext=0x1c8ccb0, pOutput=0x1c8ebfc, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2de78) returned 0x90312 [0105.811] GetLastError () returned 0x0 [0105.811] recv (in: s=0x6bc, buf=0x1c8ec8c, len=5, flags=0 | out: buf=0x1c8ec8c*) returned 5 [0105.811] GetLastError () returned 0x0 [0105.811] recv (in: s=0x6bc, buf=0x1c8eca5, len=48, flags=0 | out: buf=0x1c8eca5*) returned 48 [0105.811] GetLastError () returned 0x0 [0105.811] InitializeSecurityContextW (in: phCredential=0x7b2ddc8, phContext=0x7b2dedc, pTargetName=0x1c77944, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x1c8ed4c, Reserved2=0x0, phNewContext=0x1c8ccb0, pOutput=0x1c8ed60, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2ddc0 | out: phNewContext=0x1c8ccb0, pOutput=0x1c8ed60, pfContextAttr=0x1c8b17c, ptsExpiry=0x7b2ddc0) returned 0x0 [0105.851] GetLastError () returned 0x78 [0105.857] QueryContextAttributesW (in: phContext=0x1c8ccb0, ulAttribute=0x4, pBuffer=0x1c8ee04 | out: pBuffer=0x1c8ee04) returned 0x0 [0105.857] GetLastError () returned 0x78 [0105.857] QueryContextAttributesW (in: phContext=0x1c8ccb0, ulAttribute=0x5a, pBuffer=0x1c8ee54 | out: pBuffer=0x1c8ee54) returned 0x0 [0105.858] GetLastError () returned 0x78 [0105.864] QueryContextAttributesW (in: phContext=0x1c8ccb0, ulAttribute=0x53, pBuffer=0x1c8f120 | out: pBuffer=0x1c8f120) returned 0x0 [0105.866] GetLastError () returned 0x80092004 [0105.870] CertDuplicateCRLContext (pCrlContext=0x6e03c8) returned 0x6e03c8 [0105.870] GetLastError () returned 0x80092004 [0105.873] CertDuplicateStore (hCertStore=0x65e8a0) returned 0x65e8a0 [0105.873] GetLastError () returned 0x80092004 [0105.873] CertEnumCertificatesInStore (hCertStore=0x65e8a0, pPrevCertContext=0x0) returned 0x6e0418 [0105.873] GetLastError () returned 0x80092004 [0105.874] CertDuplicateCRLContext (pCrlContext=0x6e0418) returned 0x6e0418 [0105.874] GetLastError () returned 0x80092004 [0105.874] CertEnumCertificatesInStore (hCertStore=0x65e8a0, pPrevCertContext=0x6e0418) returned 0x6e03c8 [0105.874] GetLastError () returned 0x80092004 [0105.874] CertDuplicateCRLContext (pCrlContext=0x6e03c8) returned 0x6e03c8 [0105.874] GetLastError () returned 0x80092004 [0105.874] CertEnumCertificatesInStore (hCertStore=0x65e8a0, pPrevCertContext=0x6e03c8) returned 0x0 [0105.874] GetLastError () returned 0x80092004 [0105.874] CertCloseStore (hCertStore=0x65e8a0, dwFlags=0x0) returned 1 [0105.874] GetLastError () returned 0x80092004 [0105.874] CertFreeCRLContext (pCrlContext=0x6e03c8) returned 1 [0105.874] GetLastError () returned 0x80092004 [0105.879] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x65e918 [0105.879] GetLastError () returned 0x80092004 [0105.881] CertAddCRLLinkToStore (in: hCertStore=0x65e918, pCrlContext=0x6e0418, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0105.882] GetLastError () returned 0x80092004 [0105.882] CertAddCRLLinkToStore (in: hCertStore=0x65e918, pCrlContext=0x6e03c8, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0105.882] GetLastError () returned 0x80092004 [0105.884] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x6e03c8, pTime=0x7b2de54, hAdditionalStore=0x65e918, pChainPara=0x703400, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x7b2dd94 | out: ppChainContext=0x7b2dd94) returned 1 [0106.755] GetLastError () returned 0x80092004 [0106.759] CertDuplicateCertificateChain (pChainContext=0x80f5250) returned 0x80f5250 [0106.759] GetLastError () returned 0x80092004 [0106.760] CertDuplicateCRLContext (pCrlContext=0x6e03c8) returned 0x6e03c8 [0106.760] GetLastError () returned 0x80092004 [0106.760] CertDuplicateCRLContext (pCrlContext=0x8ea3aa8) returned 0x8ea3aa8 [0106.760] GetLastError () returned 0x80092004 [0106.760] CertDuplicateCRLContext (pCrlContext=0x8ea3af8) returned 0x8ea3af8 [0106.760] GetLastError () returned 0x80092004 [0106.760] CertFreeCertificateChain (pChainContext=0x80f5250) [0106.760] GetLastError () returned 0x80092004 [0106.762] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x80f5250, pPolicyPara=0x7b2df3c, pPolicyStatus=0x7b2df28 | out: pPolicyStatus=0x7b2df28) returned 1 [0106.762] GetLastError () returned 0x0 [0106.762] SetLastError (dwErrCode=0x0) [0106.762] GetLastError () returned 0x0 [0106.765] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x80f5250, pPolicyPara=0x7b2dfb8, pPolicyStatus=0x7b2df4c | out: pPolicyStatus=0x7b2df4c) returned 1 [0106.765] GetLastError () returned 0x0 [0106.768] CertFreeCertificateChain (pChainContext=0x80f5250) [0106.768] GetLastError () returned 0x0 [0106.768] CertFreeCRLContext (pCrlContext=0x6e03c8) returned 1 [0106.768] GetLastError () returned 0x0 [0106.770] EncryptMessage (in: phContext=0x1c8ccb0, fQOP=0x0, pMessage=0x1c966a4, MessageSeqNo=0x0 | out: pMessage=0x1c966a4) returned 0x0 [0106.770] GetLastError () returned 0x0 [0106.770] send (in: s=0x6bc, buf=0x1c96488*, len=229, flags=0 | out: buf=0x1c96488*) returned 229 [0106.771] GetLastError () returned 0x0 [0106.773] setsockopt (s=0x6bc, level=65535, optname=4102, optval="\xa0\x86\x01", optlen=4) returned 0 [0106.773] GetLastError () returned 0x0 [0106.773] recv (in: s=0x6bc, buf=0x1c967dc, len=5, flags=0 | out: buf=0x1c967dc*) returned 5 [0106.906] GetLastError () returned 0x0 [0106.906] recv (in: s=0x6bc, buf=0x1c967f5, len=480, flags=0 | out: buf=0x1c967f5*) returned 480 [0106.906] GetLastError () returned 0x0 [0106.907] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1c96a70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1c96a70, pfQOP=0x0) returned 0x0 [0106.907] GetLastError () returned 0x0 [0106.920] setsockopt (s=0x6bc, level=65535, optname=4102, optval="\xe0\x93\x04", optlen=4) returned 0 [0106.920] GetLastError () returned 0x0 [0106.920] recv (in: s=0x6bc, buf=0x1c967f0, len=5, flags=0 | out: buf=0x1c967f0*) returned 5 [0106.920] GetLastError () returned 0x0 [0106.920] recv (in: s=0x6bc, buf=0x1c967f5, len=32, flags=0 | out: buf=0x1c967f5*) returned 32 [0106.920] GetLastError () returned 0x0 [0106.920] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1c99384, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1c99384, pfQOP=0x0) returned 0x0 [0106.920] GetLastError () returned 0x0 [0106.922] recv (in: s=0x6bc, buf=0x1c967f0, len=5, flags=0 | out: buf=0x1c967f0*) returned 5 [0106.922] GetLastError () returned 0x0 [0106.922] recv (in: s=0x6bc, buf=0x1c99419, len=4336, flags=0 | out: buf=0x1c99419*) returned 4336 [0106.923] GetLastError () returned 0x0 [0106.923] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1c9a5a4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1c9a5a4, pfQOP=0x0) returned 0x0 [0106.923] GetLastError () returned 0x0 [0106.923] recv (in: s=0x6bc, buf=0x1c99414, len=5, flags=0 | out: buf=0x1c99414*) returned 5 [0106.923] GetLastError () returned 0x0 [0106.923] recv (in: s=0x6bc, buf=0x1c99419, len=4192, flags=0 | out: buf=0x1c99419*) returned 4192 [0106.923] GetLastError () returned 0x0 [0106.923] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1ca1f10, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1ca1f10, pfQOP=0x0) returned 0x0 [0106.924] GetLastError () returned 0x0 [0106.924] recv (in: s=0x6bc, buf=0x1c99414, len=5, flags=0 | out: buf=0x1c99414*) returned 5 [0106.924] GetLastError () returned 0x0 [0106.924] recv (in: s=0x6bc, buf=0x1c99419, len=32, flags=0 | out: buf=0x1c99419*) returned 32 [0106.924] GetLastError () returned 0x0 [0106.924] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1caa040, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1caa040, pfQOP=0x0) returned 0x0 [0106.924] GetLastError () returned 0x0 [0106.924] recv (in: s=0x6bc, buf=0x1c99414, len=5, flags=0 | out: buf=0x1c99414*) returned 5 [0106.924] GetLastError () returned 0x0 [0106.924] recv (in: s=0x6bc, buf=0x1c99419, len=32, flags=0 | out: buf=0x1c99419*) returned 32 [0106.924] GetLastError () returned 0x0 [0106.924] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1caa174, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1caa174, pfQOP=0x0) returned 0x0 [0106.924] GetLastError () returned 0x0 [0106.924] recv (in: s=0x6bc, buf=0x1c99414, len=5, flags=0 | out: buf=0x1c99414*) returned 5 [0106.924] GetLastError () returned 0x0 [0106.924] recv (in: s=0x6bc, buf=0x1c99419, len=4160, flags=0 | out: buf=0x1c99419*) returned 4160 [0106.924] GetLastError () returned 0x0 [0106.925] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1caa290, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1caa290, pfQOP=0x0) returned 0x0 [0106.925] GetLastError () returned 0x0 [0106.925] recv (in: s=0x6bc, buf=0x1c99414, len=5, flags=0 | out: buf=0x1c99414*) returned 5 [0106.996] GetLastError () returned 0x0 [0106.996] recv (in: s=0x6bc, buf=0x1caa949, len=4464, flags=0 | out: buf=0x1caa949*) returned 2899 [0106.996] GetLastError () returned 0x0 [0106.996] recv (in: s=0x6bc, buf=0x1cab49c, len=1565, flags=0 | out: buf=0x1cab49c*) returned 1565 [0107.229] GetLastError () returned 0x0 [0107.229] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1cabb54, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1cabb54, pfQOP=0x0) returned 0x0 [0107.229] GetLastError () returned 0x0 [0107.230] recv (in: s=0x6bc, buf=0x1caa944, len=5, flags=0 | out: buf=0x1caa944*) returned 5 [0107.230] GetLastError () returned 0x0 [0107.230] recv (in: s=0x6bc, buf=0x1caa949, len=32, flags=0 | out: buf=0x1caa949*) returned 32 [0107.230] GetLastError () returned 0x0 [0107.231] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1cbbc84, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1cbbc84, pfQOP=0x0) returned 0x0 [0107.231] GetLastError () returned 0x0 [0107.231] recv (in: s=0x6bc, buf=0x1caa944, len=5, flags=0 | out: buf=0x1caa944*) returned 5 [0107.231] GetLastError () returned 0x0 [0107.231] recv (in: s=0x6bc, buf=0x1caa949, len=48, flags=0 | out: buf=0x1caa949*) returned 48 [0107.231] GetLastError () returned 0x0 [0107.231] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1cbbdb8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1cbbdb8, pfQOP=0x0) returned 0x0 [0107.231] GetLastError () returned 0x0 [0107.231] recv (in: s=0x6bc, buf=0x1caa944, len=5, flags=0 | out: buf=0x1caa944*) returned 5 [0107.231] GetLastError () returned 0x0 [0107.231] recv (in: s=0x6bc, buf=0x1caa949, len=32, flags=0 | out: buf=0x1caa949*) returned 32 [0107.231] GetLastError () returned 0x0 [0107.231] DecryptMessage (in: phContext=0x1c8ccb0, pMessage=0x1cbbeec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x1cbbeec, pfQOP=0x0) returned 0x0 [0107.231] GetLastError () returned 0x0 [0107.231] SetEvent (hEvent=0x5d4) returned 1 [0107.231] GetLastError () returned 0x0 [0107.356] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x703400 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0107.356] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x7b2e2ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0107.356] GetLastError () returned 0x3f0 [0107.356] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat", nBufferLength=0x105, lpBuffer=0x7b2e364, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat", lpFilePart=0x0) returned 0x30 [0107.356] GetLastError () returned 0x3f0 [0107.357] SetErrorMode (uMode=0x1) returned 0x0 [0107.357] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\geo.dat"), fInfoLevelId=0x0, lpFileInformation=0x7b2e7e4 | out: lpFileInformation=0x7b2e7e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.357] GetLastError () returned 0x2 [0107.357] SetErrorMode (uMode=0x0) returned 0x1 [0107.357] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x703400 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0107.357] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x7b2e2ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0107.357] GetLastError () returned 0x3f0 [0107.358] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat", nBufferLength=0x105, lpBuffer=0x7b2e224, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat", lpFilePart=0x0) returned 0x30 [0107.358] GetLastError () returned 0x3f0 [0107.358] SetErrorMode (uMode=0x1) returned 0x0 [0107.358] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\geo.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8bc [0107.358] GetLastError () returned 0x0 [0107.358] GetFileType (hFile=0x8bc) returned 0x1 [0107.358] SetErrorMode (uMode=0x0) returned 0x1 [0107.358] GetFileType (hFile=0x8bc) returned 0x1 [0107.359] WriteFile (in: hFile=0x8bc, lpBuffer=0x1ceb0f4*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x7b2e74c, lpOverlapped=0x0 | out: lpBuffer=0x1ceb0f4*, lpNumberOfBytesWritten=0x7b2e74c*=0x21, lpOverlapped=0x0) returned 1 [0107.360] GetLastError () returned 0x0 [0107.360] CloseHandle (hObject=0x8bc) returned 1 [0107.361] GetLastError () returned 0x0 [0107.361] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x703400 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0107.361] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x7b2e2ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0107.361] GetLastError () returned 0x3f0 [0107.361] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat", nBufferLength=0x105, lpBuffer=0x7b2e364, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat", lpFilePart=0x0) returned 0x30 [0107.361] GetLastError () returned 0x3f0 [0107.361] SetErrorMode (uMode=0x1) returned 0x0 [0107.361] GetFileAttributesExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\geo.dat"), fInfoLevelId=0x0, lpFileInformation=0x7b2e7e4 | out: lpFileInformation=0x7b2e7e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d087c30, ftCreationTime.dwHighDateTime=0x1d4b1a5, ftLastAccessTime.dwLowDateTime=0x2d087c30, ftLastAccessTime.dwHighDateTime=0x1d4b1a5, ftLastWriteTime.dwLowDateTime=0x2d087c30, ftLastWriteTime.dwHighDateTime=0x1d4b1a5, nFileSizeHigh=0x0, nFileSizeLow=0x21)) returned 1 [0107.361] GetLastError () returned 0x3f0 [0107.361] SetErrorMode (uMode=0x0) returned 0x1 [0107.361] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x703400 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0107.361] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x7b2e2ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0107.361] GetLastError () returned 0x3f0 [0107.361] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat", nBufferLength=0x105, lpBuffer=0x7b2e230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat", lpFilePart=0x0) returned 0x30 [0107.361] GetLastError () returned 0x3f0 [0107.361] SetErrorMode (uMode=0x1) returned 0x0 [0107.362] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\Imminent\\Geo.dat" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\imminent\\geo.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8bc [0107.362] GetLastError () returned 0x0 [0107.362] GetFileType (hFile=0x8bc) returned 0x1 [0107.362] SetErrorMode (uMode=0x0) returned 0x1 [0107.362] GetFileType (hFile=0x8bc) returned 0x1 [0107.362] GetFileSize (in: hFile=0x8bc, lpFileSizeHigh=0x7b2e7e4 | out: lpFileSizeHigh=0x7b2e7e4*=0x0) returned 0x21 [0107.362] GetLastError () returned 0x0 [0107.362] ReadFile (in: hFile=0x8bc, lpBuffer=0x1cecf8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7b2e78c, lpOverlapped=0x0 | out: lpBuffer=0x1cecf8c*, lpNumberOfBytesRead=0x7b2e78c*=0x21, lpOverlapped=0x0) returned 1 [0107.362] GetLastError () returned 0x0 [0107.362] CloseHandle (hObject=0x8bc) returned 1 [0107.362] GetLastError () returned 0x0 [0107.364] send (in: s=0x534, buf=0x1cf1a08*, len=50, flags=0 | out: buf=0x1cf1a08*) returned 50 [0107.365] GetLastError () returned 0x0 [0107.365] CoUninitialize () Thread: id = 245 os_tid = 0xa90 Thread: id = 246 os_tid = 0xa98 [0105.417] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0105.421] ResetEvent (hEvent=0x5d4) returned 1 [0105.421] GetLastError () returned 0x0 Thread: id = 248 os_tid = 0x6c0 Thread: id = 279 os_tid = 0xbd8 [0131.672] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0136.670] WSARecv (in: s=0x534, lpBuffers=0x1dd42d0, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x73cead8, lpFlags=0x73ceb0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1dd42d0*=((len=0x1f80, buf=0x1c483d4)), lpNumberOfBytesRecvd=0x73cead8*=0x0, lpFlags=0x73ceb0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0136.670] GetLastError () returned 0x3e5 [0141.689] WSARecv (in: s=0x534, lpBuffers=0x1c9f5e8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x73cead8, lpFlags=0x73ceb0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1c9f5e8*=((len=0x1f76, buf=0x1c483de)), lpNumberOfBytesRecvd=0x73cead8*=0x0, lpFlags=0x73ceb0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0141.690] GetLastError () returned 0x3e5 [0144.542] GetLastInputInfo (in: plii=0x73cea9c | out: plii=0x73cea9c) returned 1 [0144.543] send (in: s=0x534, buf=0x1ca937c*, len=79, flags=0 | out: buf=0x1ca937c*) returned 79 [0144.543] GetLastError () returned 0x0 [0144.543] WSARecv (in: s=0x534, lpBuffers=0x1caa82c, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x73cead8, lpFlags=0x73ceb0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1caa82c*=((len=0x1f6c, buf=0x1c483e8)), lpNumberOfBytesRecvd=0x73cead8*=0x0, lpFlags=0x73ceb0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0144.543] GetLastError () returned 0x3e5 [0146.713] WSARecv (in: s=0x534, lpBuffers=0x1d84eb4, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x73cead8, lpFlags=0x73ceb0c*=0x0, lpOverlapped=0x1c4df90, lpCompletionRoutine=0x0 | out: lpBuffers=0x1d84eb4*=((len=0x1f62, buf=0x1c483f2)), lpNumberOfBytesRecvd=0x73cead8*=0x0, lpFlags=0x73ceb0c*=0x0, lpOverlapped=0x1c4df90) returned -1 [0146.713] GetLastError () returned 0x3e5 Thread: id = 281 os_tid = 0xc5c [0146.715] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Process: id = "12" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x7f1f63e0" os_pid = "0xb60" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x354" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00060a95" [0xc000000f] Region: id = 2123 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2124 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2125 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2126 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2127 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2128 start_va = 0x60000 end_va = 0x66fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2129 start_va = 0x70000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2130 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2131 start_va = 0x120000 end_va = 0x1e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2132 start_va = 0x1f0000 end_va = 0x1f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2133 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 2134 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 2135 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2136 start_va = 0x240000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2137 start_va = 0x340000 end_va = 0x440fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 2138 start_va = 0x490000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2139 start_va = 0x4a0000 end_va = 0x51ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 2140 start_va = 0x520000 end_va = 0x59ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 2141 start_va = 0x5a0000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 2142 start_va = 0x600000 end_va = 0x63ffff entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 2143 start_va = 0x640000 end_va = 0x73ffff entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 2144 start_va = 0x770000 end_va = 0x7affff entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 2145 start_va = 0x810000 end_va = 0x84ffff entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 2146 start_va = 0x8a0000 end_va = 0x8e0fff entry_point = 0x8a0000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2147 start_va = 0x8f0000 end_va = 0xbbefff entry_point = 0x8f0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2148 start_va = 0xbc0000 end_va = 0xfb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 2149 start_va = 0xfc0000 end_va = 0xffffff entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 2150 start_va = 0x10f0000 end_va = 0x112ffff entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 2151 start_va = 0x1200000 end_va = 0x123ffff entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 2152 start_va = 0x696b0000 end_va = 0x697f9fff entry_point = 0x696b0000 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 2153 start_va = 0x6cce0000 end_va = 0x6cd14fff entry_point = 0x6cce0000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 2154 start_va = 0x712f0000 end_va = 0x712fefff entry_point = 0x712f0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2155 start_va = 0x71490000 end_va = 0x714a6fff entry_point = 0x71490000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2156 start_va = 0x715a0000 end_va = 0x715aefff entry_point = 0x715a0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2157 start_va = 0x719c0000 end_va = 0x719c9fff entry_point = 0x719c0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2158 start_va = 0x719d0000 end_va = 0x719e7fff entry_point = 0x719d0000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2159 start_va = 0x719f0000 end_va = 0x71a85fff entry_point = 0x719f0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2160 start_va = 0x71f00000 end_va = 0x71f5bfff entry_point = 0x71f00000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2161 start_va = 0x744c0000 end_va = 0x744ccfff entry_point = 0x744c0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2162 start_va = 0x747f0000 end_va = 0x74814fff entry_point = 0x747f0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2163 start_va = 0x748a0000 end_va = 0x748c0fff entry_point = 0x748a0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2164 start_va = 0x752a0000 end_va = 0x752dafff entry_point = 0x752a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2165 start_va = 0x75500000 end_va = 0x75515fff entry_point = 0x75500000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2166 start_va = 0x75960000 end_va = 0x7597afff entry_point = 0x75960000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2167 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2168 start_va = 0x759f0000 end_va = 0x75a18fff entry_point = 0x759f0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2169 start_va = 0x75a20000 end_va = 0x75a2dfff entry_point = 0x75a20000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2170 start_va = 0x75c00000 end_va = 0x75c11fff entry_point = 0x75c00000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2171 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2172 start_va = 0x75c70000 end_va = 0x75c96fff entry_point = 0x75c70000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2173 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2174 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2175 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2176 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2177 start_va = 0x76b60000 end_va = 0x76b94fff entry_point = 0x76b60000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2178 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2179 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2180 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2181 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2182 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2183 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2184 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2185 start_va = 0x77410000 end_va = 0x775acfff entry_point = 0x77410000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2186 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2187 start_va = 0x77890000 end_va = 0x778d4fff entry_point = 0x77890000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2188 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2189 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2190 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2191 start_va = 0x77b00000 end_va = 0x77b05fff entry_point = 0x77b00000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2192 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2193 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 2194 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 2195 start_va = 0x7ffd8000 end_va = 0x7ffd8fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 2196 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 2197 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 2198 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 2199 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 2200 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 2201 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 2202 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 2203 start_va = 0x6ebd0000 end_va = 0x6ebd6fff entry_point = 0x6ebd0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 2204 start_va = 0x73dc0000 end_va = 0x73dc2fff entry_point = 0x73dc0000 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 2205 start_va = 0x75940000 end_va = 0x75947fff entry_point = 0x75940000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2206 start_va = 0x751d0000 end_va = 0x751d7fff entry_point = 0x751d0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2207 start_va = 0x75310000 end_va = 0x75349fff entry_point = 0x75310000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2208 start_va = 0x75aa0000 end_va = 0x75aabfff entry_point = 0x75aa0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2209 start_va = 0x75ab0000 end_va = 0x75bccfff entry_point = 0x75ab0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2210 start_va = 0x230000 end_va = 0x232fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 2211 start_va = 0x450000 end_va = 0x454fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 2212 start_va = 0x10a0000 end_va = 0x10dffff entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 2213 start_va = 0x1190000 end_va = 0x11cffff entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 2214 start_va = 0x1240000 end_va = 0x133ffff entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 2215 start_va = 0x741b0000 end_va = 0x741befff entry_point = 0x741b0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2216 start_va = 0x741c0000 end_va = 0x741c8fff entry_point = 0x741c0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2217 start_va = 0x741d0000 end_va = 0x741e0fff entry_point = 0x741d0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2218 start_va = 0x758d0000 end_va = 0x758e8fff entry_point = 0x758d0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2219 start_va = 0x7ffd6000 end_va = 0x7ffd6fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd6000" filename = "" Region: id = 2220 start_va = 0x7ffd7000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd7000" filename = "" Region: id = 2221 start_va = 0x73b20000 end_va = 0x73b2efff entry_point = 0x73b20000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2222 start_va = 0x75350000 end_va = 0x75371fff entry_point = 0x75350000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2223 start_va = 0x73db0000 end_va = 0x73dbcfff entry_point = 0x73db0000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 2224 start_va = 0x6cd20000 end_va = 0x6cd27fff entry_point = 0x6cd20000 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 2225 start_va = 0x744e0000 end_va = 0x744e8fff entry_point = 0x744e0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2226 start_va = 0x72440000 end_va = 0x7244afff entry_point = 0x72440000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2348 start_va = 0x1340000 end_va = 0x15cafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001340000" filename = "" Region: id = 2349 start_va = 0x6ccd0000 end_va = 0x6ccd8fff entry_point = 0x6ccd0000 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 2446 start_va = 0x460000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 2447 start_va = 0x15d0000 end_va = 0x16cffff entry_point = 0x0 region_type = private name = "private_0x00000000015d0000" filename = "" Region: id = 2448 start_va = 0x73b90000 end_va = 0x73c12fff entry_point = 0x73b90000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2449 start_va = 0x73d20000 end_va = 0x73d32fff entry_point = 0x73d20000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2450 start_va = 0x74f80000 end_va = 0x74f88fff entry_point = 0x74f80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2451 start_va = 0x75bd0000 end_va = 0x75bfcfff entry_point = 0x75bd0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Thread: id = 191 os_tid = 0xb88 Thread: id = 192 os_tid = 0xb78 Thread: id = 193 os_tid = 0xb74 Thread: id = 194 os_tid = 0xb70 Thread: id = 195 os_tid = 0xb6c Thread: id = 196 os_tid = 0xb68 Thread: id = 197 os_tid = 0xb64 Thread: id = 210 os_tid = 0x9f8 Thread: id = 211 os_tid = 0xa00 Thread: id = 212 os_tid = 0xa04 Process: id = "13" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x7f1f61e0" os_pid = "0x6bc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x354" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b0e0" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2564 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2565 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2566 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2567 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2568 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2569 start_va = 0xc0000 end_va = 0x187fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2570 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2571 start_va = 0x1a0000 end_va = 0x1a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 2572 start_va = 0x1b0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2573 start_va = 0x1c0000 end_va = 0x1c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 2574 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 2575 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 2576 start_va = 0x1f0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2577 start_va = 0x230000 end_va = 0x330fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 2578 start_va = 0x340000 end_va = 0x3bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 2579 start_va = 0x3c0000 end_va = 0x3c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003c0000" filename = "" Region: id = 2580 start_va = 0x3d0000 end_va = 0x3d1fff entry_point = 0x3d0000 region_type = mapped_file name = "mofd.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\mofd.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\mofd.dll.mui") Region: id = 2581 start_va = 0x3e0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 2582 start_va = 0x4e0000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 2583 start_va = 0x580000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 2584 start_va = 0x5d0000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 2585 start_va = 0x6b0000 end_va = 0x6effff entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 2586 start_va = 0x6f0000 end_va = 0x7effff entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2587 start_va = 0x830000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 2588 start_va = 0x8a0000 end_va = 0x8e0fff entry_point = 0x8a0000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2589 start_va = 0x8f0000 end_va = 0xbbefff entry_point = 0x8f0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2590 start_va = 0xbc0000 end_va = 0xfb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 2591 start_va = 0xfd0000 end_va = 0x100ffff entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 2592 start_va = 0x1070000 end_va = 0x10affff entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2593 start_va = 0x10d0000 end_va = 0x110ffff entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 2594 start_va = 0x11e0000 end_va = 0x121ffff entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 2595 start_va = 0x12b0000 end_va = 0x13affff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 2596 start_va = 0x13b0000 end_va = 0x15affff entry_point = 0x0 region_type = private name = "private_0x00000000013b0000" filename = "" Region: id = 2597 start_va = 0x15b0000 end_va = 0x19affff entry_point = 0x0 region_type = private name = "private_0x00000000015b0000" filename = "" Region: id = 2598 start_va = 0x19b0000 end_va = 0x1aaffff entry_point = 0x0 region_type = private name = "private_0x00000000019b0000" filename = "" Region: id = 2599 start_va = 0x712f0000 end_va = 0x712fefff entry_point = 0x712f0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2600 start_va = 0x71490000 end_va = 0x714a6fff entry_point = 0x71490000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2601 start_va = 0x715a0000 end_va = 0x715aefff entry_point = 0x715a0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2602 start_va = 0x719c0000 end_va = 0x719c9fff entry_point = 0x719c0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2603 start_va = 0x719d0000 end_va = 0x719e7fff entry_point = 0x719d0000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2604 start_va = 0x719f0000 end_va = 0x71a85fff entry_point = 0x719f0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2605 start_va = 0x71f00000 end_va = 0x71f5bfff entry_point = 0x71f00000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2606 start_va = 0x725a0000 end_va = 0x725d0fff entry_point = 0x725a0000 region_type = mapped_file name = "mofd.dll" filename = "\\Windows\\System32\\wbem\\mofd.dll" (normalized: "c:\\windows\\system32\\wbem\\mofd.dll") Region: id = 2607 start_va = 0x74260000 end_va = 0x74287fff entry_point = 0x74260000 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 2608 start_va = 0x748a0000 end_va = 0x748c0fff entry_point = 0x748a0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2609 start_va = 0x752a0000 end_va = 0x752dafff entry_point = 0x752a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2610 start_va = 0x75500000 end_va = 0x75515fff entry_point = 0x75500000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2611 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2612 start_va = 0x75a20000 end_va = 0x75a2dfff entry_point = 0x75a20000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2613 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2614 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2615 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2616 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2617 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2618 start_va = 0x76b60000 end_va = 0x76b94fff entry_point = 0x76b60000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2619 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2620 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2621 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2622 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2623 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2624 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2625 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2626 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2627 start_va = 0x77890000 end_va = 0x778d4fff entry_point = 0x77890000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2628 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2629 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2630 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2631 start_va = 0x77b00000 end_va = 0x77b05fff entry_point = 0x77b00000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2632 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2633 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 2634 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 2635 start_va = 0x7ffd7000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd7000" filename = "" Region: id = 2636 start_va = 0x7ffd8000 end_va = 0x7ffd8fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 2637 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 2638 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 2639 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 2640 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 2641 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 2642 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 2643 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 2644 start_va = 0x6fca0000 end_va = 0x6fcdbfff entry_point = 0x6fca0000 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 2645 start_va = 0x74bf0000 end_va = 0x74c07fff entry_point = 0x74bf0000 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 2646 start_va = 0x756c0000 end_va = 0x75701fff entry_point = 0x756c0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2698 start_va = 0x11a0000 end_va = 0x11dffff entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 2699 start_va = 0x1ab0000 end_va = 0x1d3afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ab0000" filename = "" Region: id = 2700 start_va = 0x1d40000 end_va = 0x1e38fff entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 2701 start_va = 0x1e90000 end_va = 0x1ecffff entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 2702 start_va = 0x6fce0000 end_va = 0x6fd29fff entry_point = 0x6fce0000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 2703 start_va = 0x74be0000 end_va = 0x74bedfff entry_point = 0x74be0000 region_type = mapped_file name = "netfxperf.dll" filename = "\\Windows\\System32\\netfxperf.dll" (normalized: "c:\\windows\\system32\\netfxperf.dll") Region: id = 2704 start_va = 0x7ffd6000 end_va = 0x7ffd6fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd6000" filename = "" Region: id = 2705 start_va = 0x630000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 2706 start_va = 0x2020000 end_va = 0x202ffff entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 2707 start_va = 0x21a0000 end_va = 0x21affff entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 2708 start_va = 0x698d0000 end_va = 0x69947fff entry_point = 0x698d0000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 2709 start_va = 0x771d0000 end_va = 0x77226fff entry_point = 0x771d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2710 start_va = 0x74f80000 end_va = 0x74f88fff entry_point = 0x74f80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2711 start_va = 0x6ec00000 end_va = 0x6ec33fff entry_point = 0x6ec00000 region_type = mapped_file name = "perfcounter.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\PerfCounter.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\perfcounter.dll") Region: id = 2733 start_va = 0x560000 end_va = 0x57ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 2734 start_va = 0x6d190000 end_va = 0x6d284fff entry_point = 0x6d190000 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 2735 start_va = 0x6ebe0000 end_va = 0x6ebfefff entry_point = 0x6ebe0000 region_type = mapped_file name = "corperfmonext.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CORPerfMonExt.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\corperfmonext.dll") Region: id = 2736 start_va = 0x744c0000 end_va = 0x744ccfff entry_point = 0x744c0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2749 start_va = 0x5c0000 end_va = 0x5c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 2750 start_va = 0x1f80000 end_va = 0x1fbffff entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 2751 start_va = 0x6d8d0000 end_va = 0x6d8d6fff entry_point = 0x6d8d0000 region_type = mapped_file name = "aspnet_counters.dll" filename = "\\Windows\\System32\\aspnet_counters.dll" (normalized: "c:\\windows\\system32\\aspnet_counters.dll") Region: id = 2752 start_va = 0x7ffd5000 end_va = 0x7ffd5fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 2755 start_va = 0x1030000 end_va = 0x106ffff entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 2756 start_va = 0x6d8c0000 end_va = 0x6d8c9fff entry_point = 0x6d8c0000 region_type = mapped_file name = "aspnet_perf.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Aspnet_perf.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_perf.dll") Region: id = 2758 start_va = 0x1220000 end_va = 0x125ffff entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 2759 start_va = 0x1f10000 end_va = 0x1f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 2760 start_va = 0x2100000 end_va = 0x213ffff entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 2761 start_va = 0x742b0000 end_va = 0x742b7fff entry_point = 0x742b0000 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 2762 start_va = 0x7ffd3000 end_va = 0x7ffd3fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd3000" filename = "" Region: id = 2763 start_va = 0x7ffd4000 end_va = 0x7ffd4fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd4000" filename = "" Region: id = 2764 start_va = 0x610000 end_va = 0x610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 2765 start_va = 0x6d8b0000 end_va = 0x6d8befff entry_point = 0x6d8b0000 region_type = mapped_file name = "esentprf.dll" filename = "\\Windows\\System32\\esentprf.dll" (normalized: "c:\\windows\\system32\\esentprf.dll") Region: id = 2766 start_va = 0x620000 end_va = 0x620fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 2767 start_va = 0x21b0000 end_va = 0x22affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021b0000" filename = "" Region: id = 2768 start_va = 0x22b0000 end_va = 0x23affff entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 2769 start_va = 0x75940000 end_va = 0x75947fff entry_point = 0x75940000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2771 start_va = 0x670000 end_va = 0x67ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 2772 start_va = 0x680000 end_va = 0x681fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 2773 start_va = 0x6cb00000 end_va = 0x6cb52fff entry_point = 0x6cb00000 region_type = mapped_file name = "mtxclu.dll" filename = "\\Windows\\System32\\mtxclu.dll" (normalized: "c:\\windows\\system32\\mtxclu.dll") Region: id = 2774 start_va = 0x6d090000 end_va = 0x6d121fff entry_point = 0x6d090000 region_type = mapped_file name = "msdtcprx.dll" filename = "\\Windows\\System32\\msdtcprx.dll" (normalized: "c:\\windows\\system32\\msdtcprx.dll") Region: id = 2775 start_va = 0x6d130000 end_va = 0x6d16efff entry_point = 0x6d130000 region_type = mapped_file name = "msdtcuiu.dll" filename = "\\Windows\\System32\\msdtcuiu.dll" (normalized: "c:\\windows\\system32\\msdtcuiu.dll") Region: id = 2776 start_va = 0x71510000 end_va = 0x71523fff entry_point = 0x71510000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 2777 start_va = 0x71530000 end_va = 0x7156afff entry_point = 0x71530000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 2778 start_va = 0x740d0000 end_va = 0x740d8fff entry_point = 0x740d0000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2779 start_va = 0x74500000 end_va = 0x74513fff entry_point = 0x74500000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 2780 start_va = 0x75380000 end_va = 0x753c3fff entry_point = 0x75380000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2781 start_va = 0x75630000 end_va = 0x75646fff entry_point = 0x75630000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2782 start_va = 0x75710000 end_va = 0x75720fff entry_point = 0x75710000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 2783 start_va = 0x75f10000 end_va = 0x76b59fff entry_point = 0x75f10000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2784 start_va = 0x690000 end_va = 0x690fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 2785 start_va = 0x1120000 end_va = 0x115ffff entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 2786 start_va = 0x1270000 end_va = 0x12affff entry_point = 0x0 region_type = private name = "private_0x0000000001270000" filename = "" Region: id = 2787 start_va = 0x1e50000 end_va = 0x1e8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2788 start_va = 0x2060000 end_va = 0x209ffff entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 2789 start_va = 0x20c0000 end_va = 0x20fffff entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2790 start_va = 0x2450000 end_va = 0x248ffff entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 2791 start_va = 0x2560000 end_va = 0x259ffff entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 2792 start_va = 0x2640000 end_va = 0x267ffff entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 2793 start_va = 0x26d0000 end_va = 0x270ffff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 2794 start_va = 0x2820000 end_va = 0x285ffff entry_point = 0x0 region_type = private name = "private_0x0000000002820000" filename = "" Region: id = 2795 start_va = 0x29b0000 end_va = 0x29effff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2796 start_va = 0x2a00000 end_va = 0x2a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 2797 start_va = 0x2be0000 end_va = 0x2c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 2798 start_va = 0x2e10000 end_va = 0x2e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 2799 start_va = 0x6d170000 end_va = 0x6d180fff entry_point = 0x6d170000 region_type = mapped_file name = "msscntrs.dll" filename = "\\Windows\\System32\\msscntrs.dll" (normalized: "c:\\windows\\system32\\msscntrs.dll") Region: id = 2800 start_va = 0x6a0000 end_va = 0x6a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 2801 start_va = 0x2000000 end_va = 0x200ffff entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 2802 start_va = 0x63be0000 end_va = 0x63faefff entry_point = 0x63be0000 region_type = mapped_file name = "olmapi32.dll" filename = "\\PROGRA~1\\MICROS~1\\Office15\\OLMAPI32.DLL" (normalized: "c:\\progra~1\\micros~1\\office15\\olmapi32.dll") Region: id = 2803 start_va = 0x731c0000 end_va = 0x73228fff entry_point = 0x731c0000 region_type = mapped_file name = "msvcp100.dll" filename = "\\Windows\\System32\\msvcp100.dll" (normalized: "c:\\windows\\system32\\msvcp100.dll") Region: id = 2804 start_va = 0x73850000 end_va = 0x739dffff entry_point = 0x73850000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 2805 start_va = 0x73a60000 end_va = 0x73b1efff entry_point = 0x73a60000 region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\System32\\msvcr100.dll" (normalized: "c:\\windows\\system32\\msvcr100.dll") Region: id = 2806 start_va = 0x7f0000 end_va = 0x7f0fff entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 2807 start_va = 0x800000 end_va = 0x800fff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 2808 start_va = 0x820000 end_va = 0x821fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 2809 start_va = 0x27d0000 end_va = 0x280ffff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 2810 start_va = 0x6d080000 end_va = 0x6d089fff entry_point = 0x6d080000 region_type = mapped_file name = "perfdisk.dll" filename = "\\Windows\\System32\\perfdisk.dll" (normalized: "c:\\windows\\system32\\perfdisk.dll") Region: id = 2811 start_va = 0x74a10000 end_va = 0x74badfff entry_point = 0x74a10000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 2812 start_va = 0x23b0000 end_va = 0x23effff entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 2813 start_va = 0x2430000 end_va = 0x243ffff entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 2814 start_va = 0x2860000 end_va = 0x295ffff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2815 start_va = 0x75c70000 end_va = 0x75c96fff entry_point = 0x75c70000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2816 start_va = 0x7ffaf000 end_va = 0x7ffaffff entry_point = 0x0 region_type = private name = "private_0x000000007ffaf000" filename = "" Region: id = 2850 start_va = 0x72590000 end_va = 0x72597fff entry_point = 0x72590000 region_type = mapped_file name = "perfnet.dll" filename = "\\Windows\\System32\\perfnet.dll" (normalized: "c:\\windows\\system32\\perfnet.dll") Region: id = 2851 start_va = 0x2190000 end_va = 0x219ffff entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 2852 start_va = 0x741b0000 end_va = 0x741befff entry_point = 0x741b0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2853 start_va = 0x741c0000 end_va = 0x741c8fff entry_point = 0x741c0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2854 start_va = 0x741d0000 end_va = 0x741e0fff entry_point = 0x741d0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2855 start_va = 0x758d0000 end_va = 0x758e8fff entry_point = 0x758d0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2856 start_va = 0x73db0000 end_va = 0x73dbcfff entry_point = 0x73db0000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 2857 start_va = 0x2550000 end_va = 0x255ffff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 2858 start_va = 0x6ccd0000 end_va = 0x6ccd8fff entry_point = 0x6ccd0000 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 2859 start_va = 0x2a40000 end_va = 0x2b3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 2860 start_va = 0x72580000 end_va = 0x7258afff entry_point = 0x72580000 region_type = mapped_file name = "perfproc.dll" filename = "\\Windows\\System32\\perfproc.dll" (normalized: "c:\\windows\\system32\\perfproc.dll") Region: id = 2862 start_va = 0x810000 end_va = 0x811fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 2863 start_va = 0x2c20000 end_va = 0x2d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 2864 start_va = 0x2e50000 end_va = 0x2f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e50000" filename = "" Region: id = 2865 start_va = 0x3040000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000003040000" filename = "" Region: id = 2866 start_va = 0x72010000 end_va = 0x7212dfff entry_point = 0x72010000 region_type = mapped_file name = "sysmain.dll" filename = "\\Windows\\System32\\sysmain.dll" (normalized: "c:\\windows\\system32\\sysmain.dll") Region: id = 2867 start_va = 0x75c00000 end_va = 0x75c11fff entry_point = 0x75c00000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2868 start_va = 0x77410000 end_va = 0x775acfff entry_point = 0x77410000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2869 start_va = 0x72570000 end_va = 0x72576fff entry_point = 0x72570000 region_type = mapped_file name = "rasctrs.dll" filename = "\\Windows\\System32\\rasctrs.dll" (normalized: "c:\\windows\\system32\\rasctrs.dll") Region: id = 2870 start_va = 0x6e730000 end_va = 0x6e744fff entry_point = 0x6e730000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2871 start_va = 0x25c0000 end_va = 0x25fffff entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 2872 start_va = 0x71da0000 end_va = 0x71df0fff entry_point = 0x71da0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 2873 start_va = 0x7ffae000 end_va = 0x7ffaefff entry_point = 0x0 region_type = private name = "private_0x000000007ffae000" filename = "" Region: id = 2875 start_va = 0x3180000 end_va = 0x318ffff entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 2876 start_va = 0x70520000 end_va = 0x70525fff entry_point = 0x70520000 region_type = mapped_file name = "tapiperf.dll" filename = "\\Windows\\System32\\tapiperf.dll" (normalized: "c:\\windows\\system32\\tapiperf.dll") Region: id = 2877 start_va = 0x70510000 end_va = 0x7051dfff entry_point = 0x70510000 region_type = mapped_file name = "perfctrs.dll" filename = "\\Windows\\System32\\perfctrs.dll" (normalized: "c:\\windows\\system32\\perfctrs.dll") Region: id = 2878 start_va = 0x74420000 end_va = 0x74426fff entry_point = 0x74420000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2879 start_va = 0x74430000 end_va = 0x7444bfff entry_point = 0x74430000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2880 start_va = 0x6d060000 end_va = 0x6d074fff entry_point = 0x6d060000 region_type = mapped_file name = "utildll.dll" filename = "\\Windows\\System32\\utildll.dll" (normalized: "c:\\windows\\system32\\utildll.dll") Region: id = 2881 start_va = 0x70500000 end_va = 0x70507fff entry_point = 0x70500000 region_type = mapped_file name = "perfts.dll" filename = "\\Windows\\System32\\perfts.dll" (normalized: "c:\\windows\\system32\\perfts.dll") Region: id = 2882 start_va = 0x73b20000 end_va = 0x73b2efff entry_point = 0x73b20000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2883 start_va = 0x75350000 end_va = 0x75371fff entry_point = 0x75350000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2884 start_va = 0x759f0000 end_va = 0x75a18fff entry_point = 0x759f0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2885 start_va = 0x2530000 end_va = 0x253ffff entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 2886 start_va = 0x3050000 end_va = 0x314ffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 2887 start_va = 0x6d030000 end_va = 0x6d035fff entry_point = 0x6d030000 region_type = mapped_file name = "usbperf.dll" filename = "\\Windows\\System32\\usbperf.dll" (normalized: "c:\\windows\\system32\\usbperf.dll") Region: id = 2888 start_va = 0x6cac0000 end_va = 0x6cadefff entry_point = 0x6cac0000 region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll") Region: id = 2889 start_va = 0x6cae0000 end_va = 0x6caf9fff entry_point = 0x6cae0000 region_type = mapped_file name = "wmiaprpl.dll" filename = "\\Windows\\System32\\wbem\\WmiApRpl.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiaprpl.dll") Region: id = 2890 start_va = 0x870000 end_va = 0x870fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 2891 start_va = 0x6b6e0000 end_va = 0x6b85bfff entry_point = 0x6b6e0000 region_type = mapped_file name = "tquery.dll" filename = "\\Windows\\System32\\tquery.dll" (normalized: "c:\\windows\\system32\\tquery.dll") Region: id = 3002 start_va = 0x880000 end_va = 0x880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 3003 start_va = 0x3190000 end_va = 0x3290fff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 3004 start_va = 0x3330000 end_va = 0x336ffff entry_point = 0x0 region_type = private name = "private_0x0000000003330000" filename = "" Region: id = 3005 start_va = 0x75090000 end_va = 0x7509afff entry_point = 0x75090000 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Thread: id = 198 os_tid = 0xebc Thread: id = 199 os_tid = 0x778 Thread: id = 200 os_tid = 0x768 Thread: id = 201 os_tid = 0x5e8 Thread: id = 202 os_tid = 0x578 Thread: id = 203 os_tid = 0x6f0 Thread: id = 204 os_tid = 0x278 Thread: id = 205 os_tid = 0x6d4 Thread: id = 242 os_tid = 0xaa8 Thread: id = 247 os_tid = 0xa94 Thread: id = 249 os_tid = 0x414 Thread: id = 250 os_tid = 0x3c0 Thread: id = 251 os_tid = 0xabc Thread: id = 252 os_tid = 0xa78 Thread: id = 271 os_tid = 0x534 Process: id = "14" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x7f1f6440" os_pid = "0xa18" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x30c" cmd_line = "\"C:\\Windows\\System32\\schtasks.exe\" /create /tn RtkAudioService64 /tr \"C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe\" /sc minute /mo 1 /F" cur_dir = "C:\\Windows\\system32\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2251 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2252 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2253 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2254 start_va = 0x130000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2255 start_va = 0xce0000 end_va = 0xd0dfff entry_point = 0xce0000 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2256 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2257 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2258 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 2259 start_va = 0x7ffd8000 end_va = 0x7ffd8fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 2260 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 2278 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2279 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2280 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2281 start_va = 0x1c0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2282 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2283 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2284 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 2285 start_va = 0x740d0000 end_va = 0x740d8fff entry_point = 0x740d0000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2286 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2287 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2288 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2289 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2290 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2291 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2292 start_va = 0x771d0000 end_va = 0x77226fff entry_point = 0x771d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2293 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2294 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2295 start_va = 0x2c0000 end_va = 0x387fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2296 start_va = 0x460000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 2297 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2298 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2299 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2300 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2301 start_va = 0xe0000 end_va = 0xf1fff entry_point = 0xe0000 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2302 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2303 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2304 start_va = 0x470000 end_va = 0x570fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 2305 start_va = 0xd10000 end_va = 0x190ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 2306 start_va = 0x74f80000 end_va = 0x74f88fff entry_point = 0x74f80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2307 start_va = 0x580000 end_va = 0x84efff entry_point = 0x580000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2308 start_va = 0x390000 end_va = 0x3ebfff entry_point = 0x390000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2309 start_va = 0x390000 end_va = 0x3ebfff entry_point = 0x390000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2310 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2311 start_va = 0x74060000 end_va = 0x7409ffff entry_point = 0x74060000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2312 start_va = 0x390000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 2313 start_va = 0x850000 end_va = 0x92efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 2314 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2339 start_va = 0xaa0000 end_va = 0xadffff entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 2340 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2341 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 2342 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2343 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2344 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2345 start_va = 0x74640000 end_va = 0x746bcfff entry_point = 0x74640000 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2347 start_va = 0x75960000 end_va = 0x7597afff entry_point = 0x75960000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2390 start_va = 0x740a0000 end_va = 0x740cefff entry_point = 0x740a0000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 214 os_tid = 0xa10 [0094.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16faec | out: lpSystemTimeAsFileTime=0x16faec*(dwLowDateTime=0x26608170, dwHighDateTime=0x1d4b1a5)) [0094.540] GetCurrentProcessId () returned 0xa18 [0094.540] GetCurrentThreadId () returned 0xa10 [0094.540] GetTickCount () returned 0xa70292 [0094.540] RtlQueryPerformanceCounter () returned 0x1 [0094.541] GetModuleHandleA (lpModuleName=0x0) returned 0xce0000 [0094.541] __set_app_type (_Type=0x1) [0094.541] __p__fmode () returned 0x76cf31f4 [0094.541] __p__commode () returned 0x76cf31fc [0094.541] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xcf7881) returned 0x0 [0094.542] __wgetmainargs (in: _Argc=0xd09e6c, _Argv=0xd09e74, _Env=0xd09e70, _DoWildCard=0, _StartInfo=0xd09e80 | out: _Argc=0xd09e6c, _Argv=0xd09e74, _Env=0xd09e70) returned 0 [0094.542] _onexit (_Func=0xd00fe2) returned 0xd00fe2 [0094.542] _onexit (_Func=0xd00ff3) returned 0xd00ff3 [0094.542] _onexit (_Func=0xd01002) returned 0xd01002 [0094.542] _onexit (_Func=0xd0101e) returned 0xd0101e [0094.542] _onexit (_Func=0xd0103a) returned 0xd0103a [0094.542] _onexit (_Func=0xd01056) returned 0xd01056 [0094.542] _onexit (_Func=0xd01072) returned 0xd01072 [0094.543] _onexit (_Func=0xd0108e) returned 0xd0108e [0094.543] _onexit (_Func=0xd010aa) returned 0xd010aa [0094.543] _onexit (_Func=0xd010c6) returned 0xd010c6 [0094.543] _onexit (_Func=0xd010e2) returned 0xd010e2 [0094.543] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0094.543] WinSqmIsOptedIn () returned 0x0 [0094.543] SetLastError (dwErrCode=0x0) [0094.543] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0094.543] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0094.543] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0094.543] VerifyVersionInfoW (in: lpVersionInformation=0x16f564, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x16f564) returned 1 [0094.543] lstrlenW (lpString="") returned 0 [0094.544] SetThreadUILanguage (LangId=0x0) returned 0x409 [0094.594] SetLastError (dwErrCode=0x0) [0094.594] _memicmp (_Buf1=0x1ce388, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.594] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d2ac0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0094.594] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x74f80000 [0094.596] GetProcAddress (hModule=0x74f80000, lpProcName="GetFileVersionInfoSizeW") returned 0x74f819d9 [0094.596] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\System32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0094.596] GetProcAddress (hModule=0x74f80000, lpProcName="GetFileVersionInfoW") returned 0x74f819f4 [0094.596] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\System32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1d2ff0 | out: lpData=0x1d2ff0) returned 1 [0094.596] GetProcAddress (hModule=0x74f80000, lpProcName="VerQueryValueW") returned 0x74f81b51 [0094.596] VerQueryValueW (in: pBlock=0x1d2ff0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x16f66c, puLen=0x16f670 | out: lplpBuffer=0x16f66c*=0x1d338c, puLen=0x16f670) returned 1 [0094.597] _memicmp (_Buf1=0x1ce388, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.597] _vsnwprintf (in: _Buffer=0x1d2ac0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x16f654 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0094.597] VerQueryValueW (in: pBlock=0x1d2ff0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x16f67c, puLen=0x16f678 | out: lplpBuffer=0x16f67c*=0x1d31b8, puLen=0x16f678) returned 1 [0094.597] lstrlenW (lpString="schtasks.exe") returned 12 [0094.597] lstrlenW (lpString="schtasks.exe") returned 12 [0094.597] lstrlenW (lpString=".EXE") returned 4 [0094.597] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0094.598] lstrlenW (lpString="schtasks.exe") returned 12 [0094.598] lstrlenW (lpString=".EXE") returned 4 [0094.598] _memicmp (_Buf1=0x1ce388, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.598] lstrlenW (lpString="schtasks") returned 8 [0094.598] _memicmp (_Buf1=0x1ce3e8, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.598] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.598] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0094.598] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0094.598] _vsnwprintf (in: _Buffer=0x1d3748, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x16f658 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0094.599] SetLastError (dwErrCode=0x0) [0094.599] GetThreadLocale () returned 0x409 [0094.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.599] lstrlenW (lpString="?") returned 1 [0094.599] GetThreadLocale () returned 0x409 [0094.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.599] lstrlenW (lpString="create") returned 6 [0094.599] GetThreadLocale () returned 0x409 [0094.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.599] lstrlenW (lpString="delete") returned 6 [0094.599] GetThreadLocale () returned 0x409 [0094.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.599] lstrlenW (lpString="query") returned 5 [0094.599] GetThreadLocale () returned 0x409 [0094.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.599] lstrlenW (lpString="change") returned 6 [0094.599] GetThreadLocale () returned 0x409 [0094.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.599] lstrlenW (lpString="run") returned 3 [0094.599] GetThreadLocale () returned 0x409 [0094.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.599] lstrlenW (lpString="end") returned 3 [0094.599] GetThreadLocale () returned 0x409 [0094.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.599] lstrlenW (lpString="showsid") returned 7 [0094.599] GetThreadLocale () returned 0x409 [0094.599] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.599] SetLastError (dwErrCode=0x0) [0094.599] SetLastError (dwErrCode=0x0) [0094.599] lstrlenW (lpString="/create") returned 7 [0094.599] lstrlenW (lpString="-/") returned 2 [0094.599] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.599] lstrlenW (lpString="?") returned 1 [0094.599] lstrlenW (lpString="?") returned 1 [0094.600] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.600] lstrlenW (lpString="create") returned 6 [0094.600] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.600] _vsnwprintf (in: _Buffer=0x1ce430, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|?|") returned 3 [0094.600] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|create|") returned 8 [0094.600] lstrlenW (lpString="|?|") returned 3 [0094.600] lstrlenW (lpString="|create|") returned 8 [0094.600] SetLastError (dwErrCode=0x490) [0094.600] lstrlenW (lpString="create") returned 6 [0094.600] lstrlenW (lpString="create") returned 6 [0094.600] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.600] lstrlenW (lpString="create") returned 6 [0094.600] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.600] _vsnwprintf (in: _Buffer=0x1d2378, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|create|") returned 8 [0094.600] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|create|") returned 8 [0094.600] lstrlenW (lpString="|create|") returned 8 [0094.600] lstrlenW (lpString="|create|") returned 8 [0094.600] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0094.600] SetLastError (dwErrCode=0x0) [0094.600] SetLastError (dwErrCode=0x0) [0094.600] SetLastError (dwErrCode=0x0) [0094.600] lstrlenW (lpString="/tn") returned 3 [0094.600] lstrlenW (lpString="-/") returned 2 [0094.600] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.600] lstrlenW (lpString="?") returned 1 [0094.600] lstrlenW (lpString="?") returned 1 [0094.600] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.600] lstrlenW (lpString="tn") returned 2 [0094.600] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.600] _vsnwprintf (in: _Buffer=0x1d2378, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|?|") returned 3 [0094.600] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tn|") returned 4 [0094.601] lstrlenW (lpString="|?|") returned 3 [0094.601] lstrlenW (lpString="|tn|") returned 4 [0094.601] SetLastError (dwErrCode=0x490) [0094.601] lstrlenW (lpString="create") returned 6 [0094.601] lstrlenW (lpString="create") returned 6 [0094.601] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.601] lstrlenW (lpString="tn") returned 2 [0094.601] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.601] _vsnwprintf (in: _Buffer=0x1d2378, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|create|") returned 8 [0094.601] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tn|") returned 4 [0094.601] lstrlenW (lpString="|create|") returned 8 [0094.601] lstrlenW (lpString="|tn|") returned 4 [0094.601] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0094.601] SetLastError (dwErrCode=0x490) [0094.601] lstrlenW (lpString="delete") returned 6 [0094.601] lstrlenW (lpString="delete") returned 6 [0094.601] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.601] lstrlenW (lpString="tn") returned 2 [0094.601] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.601] _vsnwprintf (in: _Buffer=0x1d2378, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|delete|") returned 8 [0094.601] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tn|") returned 4 [0094.601] lstrlenW (lpString="|delete|") returned 8 [0094.601] lstrlenW (lpString="|tn|") returned 4 [0094.601] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0094.601] SetLastError (dwErrCode=0x490) [0094.601] lstrlenW (lpString="query") returned 5 [0094.601] lstrlenW (lpString="query") returned 5 [0094.601] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.601] lstrlenW (lpString="tn") returned 2 [0094.601] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.601] _vsnwprintf (in: _Buffer=0x1d2378, _BufferCount=0x8, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|query|") returned 7 [0094.601] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tn|") returned 4 [0094.601] lstrlenW (lpString="|query|") returned 7 [0094.601] lstrlenW (lpString="|tn|") returned 4 [0094.601] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0094.601] SetLastError (dwErrCode=0x490) [0094.601] lstrlenW (lpString="change") returned 6 [0094.601] lstrlenW (lpString="change") returned 6 [0094.601] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.602] lstrlenW (lpString="tn") returned 2 [0094.602] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.602] _vsnwprintf (in: _Buffer=0x1d2378, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|change|") returned 8 [0094.602] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tn|") returned 4 [0094.602] lstrlenW (lpString="|change|") returned 8 [0094.602] lstrlenW (lpString="|tn|") returned 4 [0094.602] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0094.602] SetLastError (dwErrCode=0x490) [0094.602] lstrlenW (lpString="run") returned 3 [0094.602] lstrlenW (lpString="run") returned 3 [0094.602] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.602] lstrlenW (lpString="tn") returned 2 [0094.602] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.602] _vsnwprintf (in: _Buffer=0x1d2378, _BufferCount=0x6, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|run|") returned 5 [0094.602] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tn|") returned 4 [0094.602] lstrlenW (lpString="|run|") returned 5 [0094.602] lstrlenW (lpString="|tn|") returned 4 [0094.602] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0094.602] SetLastError (dwErrCode=0x490) [0094.602] lstrlenW (lpString="end") returned 3 [0094.602] lstrlenW (lpString="end") returned 3 [0094.602] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.602] lstrlenW (lpString="tn") returned 2 [0094.602] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.602] _vsnwprintf (in: _Buffer=0x1d2378, _BufferCount=0x6, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|end|") returned 5 [0094.602] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tn|") returned 4 [0094.602] lstrlenW (lpString="|end|") returned 5 [0094.602] lstrlenW (lpString="|tn|") returned 4 [0094.602] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0094.602] SetLastError (dwErrCode=0x490) [0094.602] lstrlenW (lpString="showsid") returned 7 [0094.602] lstrlenW (lpString="showsid") returned 7 [0094.602] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.602] lstrlenW (lpString="tn") returned 2 [0094.602] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.602] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0xa, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|showsid|") returned 9 [0094.603] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tn|") returned 4 [0094.603] lstrlenW (lpString="|showsid|") returned 9 [0094.603] lstrlenW (lpString="|tn|") returned 4 [0094.603] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0094.603] SetLastError (dwErrCode=0x490) [0094.603] SetLastError (dwErrCode=0x490) [0094.603] SetLastError (dwErrCode=0x0) [0094.603] lstrlenW (lpString="/tn") returned 3 [0094.603] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0094.603] SetLastError (dwErrCode=0x490) [0094.603] SetLastError (dwErrCode=0x0) [0094.603] lstrlenW (lpString="/tn") returned 3 [0094.603] SetLastError (dwErrCode=0x0) [0094.603] SetLastError (dwErrCode=0x0) [0094.603] lstrlenW (lpString="RtkAudioService64") returned 17 [0094.603] lstrlenW (lpString="-/") returned 2 [0094.603] StrChrIW (lpStart="-/", wMatch=0x52) returned 0x0 [0094.603] SetLastError (dwErrCode=0x490) [0094.603] SetLastError (dwErrCode=0x490) [0094.603] SetLastError (dwErrCode=0x0) [0094.603] lstrlenW (lpString="RtkAudioService64") returned 17 [0094.603] StrChrIW (lpStart="RtkAudioService64", wMatch=0x3a) returned 0x0 [0094.603] SetLastError (dwErrCode=0x490) [0094.603] SetLastError (dwErrCode=0x0) [0094.603] lstrlenW (lpString="RtkAudioService64") returned 17 [0094.603] SetLastError (dwErrCode=0x0) [0094.603] SetLastError (dwErrCode=0x0) [0094.603] lstrlenW (lpString="/tr") returned 3 [0094.603] lstrlenW (lpString="-/") returned 2 [0094.603] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.603] lstrlenW (lpString="?") returned 1 [0094.603] lstrlenW (lpString="?") returned 1 [0094.603] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.603] lstrlenW (lpString="tr") returned 2 [0094.603] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.603] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|?|") returned 3 [0094.603] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tr|") returned 4 [0094.604] lstrlenW (lpString="|?|") returned 3 [0094.604] lstrlenW (lpString="|tr|") returned 4 [0094.604] SetLastError (dwErrCode=0x490) [0094.604] lstrlenW (lpString="create") returned 6 [0094.604] lstrlenW (lpString="create") returned 6 [0094.604] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.604] lstrlenW (lpString="tr") returned 2 [0094.604] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.604] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|create|") returned 8 [0094.604] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tr|") returned 4 [0094.604] lstrlenW (lpString="|create|") returned 8 [0094.604] lstrlenW (lpString="|tr|") returned 4 [0094.604] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0094.604] SetLastError (dwErrCode=0x490) [0094.604] lstrlenW (lpString="delete") returned 6 [0094.604] lstrlenW (lpString="delete") returned 6 [0094.604] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.604] lstrlenW (lpString="tr") returned 2 [0094.604] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.604] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|delete|") returned 8 [0094.604] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tr|") returned 4 [0094.604] lstrlenW (lpString="|delete|") returned 8 [0094.604] lstrlenW (lpString="|tr|") returned 4 [0094.604] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0094.604] SetLastError (dwErrCode=0x490) [0094.604] lstrlenW (lpString="query") returned 5 [0094.604] lstrlenW (lpString="query") returned 5 [0094.604] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.604] lstrlenW (lpString="tr") returned 2 [0094.604] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.604] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x8, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|query|") returned 7 [0094.604] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tr|") returned 4 [0094.604] lstrlenW (lpString="|query|") returned 7 [0094.604] lstrlenW (lpString="|tr|") returned 4 [0094.604] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0094.604] SetLastError (dwErrCode=0x490) [0094.604] lstrlenW (lpString="change") returned 6 [0094.604] lstrlenW (lpString="change") returned 6 [0094.604] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.605] lstrlenW (lpString="tr") returned 2 [0094.605] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.605] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|change|") returned 8 [0094.605] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tr|") returned 4 [0094.605] lstrlenW (lpString="|change|") returned 8 [0094.605] lstrlenW (lpString="|tr|") returned 4 [0094.605] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0094.605] SetLastError (dwErrCode=0x490) [0094.605] lstrlenW (lpString="run") returned 3 [0094.605] lstrlenW (lpString="run") returned 3 [0094.605] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.605] lstrlenW (lpString="tr") returned 2 [0094.605] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.605] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|run|") returned 5 [0094.605] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tr|") returned 4 [0094.605] lstrlenW (lpString="|run|") returned 5 [0094.605] lstrlenW (lpString="|tr|") returned 4 [0094.605] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0094.605] SetLastError (dwErrCode=0x490) [0094.605] lstrlenW (lpString="end") returned 3 [0094.605] lstrlenW (lpString="end") returned 3 [0094.605] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.605] lstrlenW (lpString="tr") returned 2 [0094.605] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.605] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|end|") returned 5 [0094.605] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tr|") returned 4 [0094.605] lstrlenW (lpString="|end|") returned 5 [0094.605] lstrlenW (lpString="|tr|") returned 4 [0094.605] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0094.605] SetLastError (dwErrCode=0x490) [0094.605] lstrlenW (lpString="showsid") returned 7 [0094.605] lstrlenW (lpString="showsid") returned 7 [0094.605] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.605] lstrlenW (lpString="tr") returned 2 [0094.605] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.605] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0xa, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|showsid|") returned 9 [0094.605] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|tr|") returned 4 [0094.605] lstrlenW (lpString="|showsid|") returned 9 [0094.606] lstrlenW (lpString="|tr|") returned 4 [0094.606] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0094.606] SetLastError (dwErrCode=0x490) [0094.606] SetLastError (dwErrCode=0x490) [0094.606] SetLastError (dwErrCode=0x0) [0094.606] lstrlenW (lpString="/tr") returned 3 [0094.606] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0094.606] SetLastError (dwErrCode=0x490) [0094.606] SetLastError (dwErrCode=0x0) [0094.606] lstrlenW (lpString="/tr") returned 3 [0094.606] SetLastError (dwErrCode=0x0) [0094.606] SetLastError (dwErrCode=0x0) [0094.606] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.606] lstrlenW (lpString="-/") returned 2 [0094.606] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0094.606] SetLastError (dwErrCode=0x490) [0094.606] SetLastError (dwErrCode=0x490) [0094.606] SetLastError (dwErrCode=0x0) [0094.606] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.606] StrChrIW (lpStart="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", wMatch=0x3a) returned=":\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" [0094.606] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.606] _memicmp (_Buf1=0x1ce430, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.606] _memicmp (_Buf1=0x1ce478, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.606] SetLastError (dwErrCode=0x7a) [0094.606] SetLastError (dwErrCode=0x0) [0094.606] SetLastError (dwErrCode=0x0) [0094.606] lstrlenW (lpString="C") returned 1 [0094.606] SetLastError (dwErrCode=0x490) [0094.606] SetLastError (dwErrCode=0x0) [0094.606] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.606] SetLastError (dwErrCode=0x0) [0094.606] SetLastError (dwErrCode=0x0) [0094.606] lstrlenW (lpString="/sc") returned 3 [0094.606] lstrlenW (lpString="-/") returned 2 [0094.606] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.607] lstrlenW (lpString="?") returned 1 [0094.607] lstrlenW (lpString="?") returned 1 [0094.607] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.607] lstrlenW (lpString="sc") returned 2 [0094.607] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.607] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|?|") returned 3 [0094.607] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|sc|") returned 4 [0094.607] lstrlenW (lpString="|?|") returned 3 [0094.607] lstrlenW (lpString="|sc|") returned 4 [0094.607] SetLastError (dwErrCode=0x490) [0094.607] lstrlenW (lpString="create") returned 6 [0094.607] lstrlenW (lpString="create") returned 6 [0094.607] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.607] lstrlenW (lpString="sc") returned 2 [0094.607] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.607] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|create|") returned 8 [0094.607] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|sc|") returned 4 [0094.607] lstrlenW (lpString="|create|") returned 8 [0094.607] lstrlenW (lpString="|sc|") returned 4 [0094.607] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0094.607] SetLastError (dwErrCode=0x490) [0094.607] lstrlenW (lpString="delete") returned 6 [0094.607] lstrlenW (lpString="delete") returned 6 [0094.607] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.607] lstrlenW (lpString="sc") returned 2 [0094.607] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.607] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|delete|") returned 8 [0094.607] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|sc|") returned 4 [0094.607] lstrlenW (lpString="|delete|") returned 8 [0094.607] lstrlenW (lpString="|sc|") returned 4 [0094.607] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0094.607] SetLastError (dwErrCode=0x490) [0094.607] lstrlenW (lpString="query") returned 5 [0094.607] lstrlenW (lpString="query") returned 5 [0094.607] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.607] lstrlenW (lpString="sc") returned 2 [0094.607] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.608] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x8, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|query|") returned 7 [0094.608] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|sc|") returned 4 [0094.608] lstrlenW (lpString="|query|") returned 7 [0094.608] lstrlenW (lpString="|sc|") returned 4 [0094.608] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0094.608] SetLastError (dwErrCode=0x490) [0094.608] lstrlenW (lpString="change") returned 6 [0094.608] lstrlenW (lpString="change") returned 6 [0094.608] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.608] lstrlenW (lpString="sc") returned 2 [0094.608] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.608] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|change|") returned 8 [0094.608] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|sc|") returned 4 [0094.608] lstrlenW (lpString="|change|") returned 8 [0094.608] lstrlenW (lpString="|sc|") returned 4 [0094.608] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0094.608] SetLastError (dwErrCode=0x490) [0094.608] lstrlenW (lpString="run") returned 3 [0094.608] lstrlenW (lpString="run") returned 3 [0094.608] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.608] lstrlenW (lpString="sc") returned 2 [0094.608] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.608] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|run|") returned 5 [0094.608] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|sc|") returned 4 [0094.608] lstrlenW (lpString="|run|") returned 5 [0094.608] lstrlenW (lpString="|sc|") returned 4 [0094.608] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0094.608] SetLastError (dwErrCode=0x490) [0094.608] lstrlenW (lpString="end") returned 3 [0094.608] lstrlenW (lpString="end") returned 3 [0094.608] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.608] lstrlenW (lpString="sc") returned 2 [0094.608] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.608] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|end|") returned 5 [0094.608] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|sc|") returned 4 [0094.608] lstrlenW (lpString="|end|") returned 5 [0094.608] lstrlenW (lpString="|sc|") returned 4 [0094.608] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0094.609] SetLastError (dwErrCode=0x490) [0094.609] lstrlenW (lpString="showsid") returned 7 [0094.609] lstrlenW (lpString="showsid") returned 7 [0094.609] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.609] lstrlenW (lpString="sc") returned 2 [0094.609] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.609] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0xa, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|showsid|") returned 9 [0094.609] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|sc|") returned 4 [0094.609] lstrlenW (lpString="|showsid|") returned 9 [0094.609] lstrlenW (lpString="|sc|") returned 4 [0094.609] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0094.609] SetLastError (dwErrCode=0x490) [0094.609] SetLastError (dwErrCode=0x490) [0094.609] SetLastError (dwErrCode=0x0) [0094.609] lstrlenW (lpString="/sc") returned 3 [0094.609] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0094.609] SetLastError (dwErrCode=0x490) [0094.609] SetLastError (dwErrCode=0x0) [0094.609] lstrlenW (lpString="/sc") returned 3 [0094.609] SetLastError (dwErrCode=0x0) [0094.609] SetLastError (dwErrCode=0x0) [0094.609] lstrlenW (lpString="minute") returned 6 [0094.609] lstrlenW (lpString="-/") returned 2 [0094.609] StrChrIW (lpStart="-/", wMatch=0x6d) returned 0x0 [0094.609] SetLastError (dwErrCode=0x490) [0094.609] SetLastError (dwErrCode=0x490) [0094.609] SetLastError (dwErrCode=0x0) [0094.609] lstrlenW (lpString="minute") returned 6 [0094.609] StrChrIW (lpStart="minute", wMatch=0x3a) returned 0x0 [0094.609] SetLastError (dwErrCode=0x490) [0094.609] SetLastError (dwErrCode=0x0) [0094.609] lstrlenW (lpString="minute") returned 6 [0094.609] SetLastError (dwErrCode=0x0) [0094.609] SetLastError (dwErrCode=0x0) [0094.609] lstrlenW (lpString="/mo") returned 3 [0094.609] lstrlenW (lpString="-/") returned 2 [0094.609] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.609] lstrlenW (lpString="?") returned 1 [0094.609] lstrlenW (lpString="?") returned 1 [0094.610] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.610] lstrlenW (lpString="mo") returned 2 [0094.610] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.610] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|?|") returned 3 [0094.610] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|mo|") returned 4 [0094.610] lstrlenW (lpString="|?|") returned 3 [0094.610] lstrlenW (lpString="|mo|") returned 4 [0094.610] SetLastError (dwErrCode=0x490) [0094.610] lstrlenW (lpString="create") returned 6 [0094.610] lstrlenW (lpString="create") returned 6 [0094.610] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.610] lstrlenW (lpString="mo") returned 2 [0094.610] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.610] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|create|") returned 8 [0094.610] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|mo|") returned 4 [0094.610] lstrlenW (lpString="|create|") returned 8 [0094.610] lstrlenW (lpString="|mo|") returned 4 [0094.610] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0094.610] SetLastError (dwErrCode=0x490) [0094.610] lstrlenW (lpString="delete") returned 6 [0094.610] lstrlenW (lpString="delete") returned 6 [0094.610] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.610] lstrlenW (lpString="mo") returned 2 [0094.610] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.610] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|delete|") returned 8 [0094.610] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|mo|") returned 4 [0094.610] lstrlenW (lpString="|delete|") returned 8 [0094.610] lstrlenW (lpString="|mo|") returned 4 [0094.610] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0094.610] SetLastError (dwErrCode=0x490) [0094.610] lstrlenW (lpString="query") returned 5 [0094.610] lstrlenW (lpString="query") returned 5 [0094.610] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.610] lstrlenW (lpString="mo") returned 2 [0094.610] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.610] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x8, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|query|") returned 7 [0094.610] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|mo|") returned 4 [0094.611] lstrlenW (lpString="|query|") returned 7 [0094.611] lstrlenW (lpString="|mo|") returned 4 [0094.611] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0094.611] SetLastError (dwErrCode=0x490) [0094.611] lstrlenW (lpString="change") returned 6 [0094.611] lstrlenW (lpString="change") returned 6 [0094.611] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.611] lstrlenW (lpString="mo") returned 2 [0094.611] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.611] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|change|") returned 8 [0094.611] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|mo|") returned 4 [0094.611] lstrlenW (lpString="|change|") returned 8 [0094.611] lstrlenW (lpString="|mo|") returned 4 [0094.611] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0094.611] SetLastError (dwErrCode=0x490) [0094.611] lstrlenW (lpString="run") returned 3 [0094.611] lstrlenW (lpString="run") returned 3 [0094.611] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.611] lstrlenW (lpString="mo") returned 2 [0094.611] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.611] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|run|") returned 5 [0094.611] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|mo|") returned 4 [0094.611] lstrlenW (lpString="|run|") returned 5 [0094.611] lstrlenW (lpString="|mo|") returned 4 [0094.611] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0094.611] SetLastError (dwErrCode=0x490) [0094.611] lstrlenW (lpString="end") returned 3 [0094.611] lstrlenW (lpString="end") returned 3 [0094.611] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.611] lstrlenW (lpString="mo") returned 2 [0094.611] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.611] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|end|") returned 5 [0094.611] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|mo|") returned 4 [0094.611] lstrlenW (lpString="|end|") returned 5 [0094.611] lstrlenW (lpString="|mo|") returned 4 [0094.611] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0094.612] SetLastError (dwErrCode=0x490) [0094.612] lstrlenW (lpString="showsid") returned 7 [0094.612] lstrlenW (lpString="showsid") returned 7 [0094.612] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.612] lstrlenW (lpString="mo") returned 2 [0094.612] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.612] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0xa, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|showsid|") returned 9 [0094.612] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|mo|") returned 4 [0094.612] lstrlenW (lpString="|showsid|") returned 9 [0094.612] lstrlenW (lpString="|mo|") returned 4 [0094.612] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0094.612] SetLastError (dwErrCode=0x490) [0094.612] SetLastError (dwErrCode=0x490) [0094.612] SetLastError (dwErrCode=0x0) [0094.612] lstrlenW (lpString="/mo") returned 3 [0094.612] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0094.612] SetLastError (dwErrCode=0x490) [0094.612] SetLastError (dwErrCode=0x0) [0094.612] lstrlenW (lpString="/mo") returned 3 [0094.612] SetLastError (dwErrCode=0x0) [0094.612] SetLastError (dwErrCode=0x0) [0094.612] lstrlenW (lpString="1") returned 1 [0094.612] SetLastError (dwErrCode=0x490) [0094.612] SetLastError (dwErrCode=0x0) [0094.612] lstrlenW (lpString="1") returned 1 [0094.612] StrChrIW (lpStart="1", wMatch=0x3a) returned 0x0 [0094.612] SetLastError (dwErrCode=0x490) [0094.612] SetLastError (dwErrCode=0x0) [0094.612] lstrlenW (lpString="1") returned 1 [0094.612] SetLastError (dwErrCode=0x0) [0094.612] SetLastError (dwErrCode=0x0) [0094.612] lstrlenW (lpString="/F") returned 2 [0094.612] lstrlenW (lpString="-/") returned 2 [0094.612] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.612] lstrlenW (lpString="?") returned 1 [0094.612] lstrlenW (lpString="?") returned 1 [0094.612] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.612] lstrlenW (lpString="F") returned 1 [0094.612] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.613] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|?|") returned 3 [0094.613] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|F|") returned 3 [0094.613] lstrlenW (lpString="|?|") returned 3 [0094.613] lstrlenW (lpString="|F|") returned 3 [0094.613] StrStrIW (lpFirst="|?|", lpSrch="|F|") returned 0x0 [0094.613] SetLastError (dwErrCode=0x490) [0094.613] lstrlenW (lpString="create") returned 6 [0094.613] lstrlenW (lpString="create") returned 6 [0094.613] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.613] lstrlenW (lpString="F") returned 1 [0094.613] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.613] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|create|") returned 8 [0094.613] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|F|") returned 3 [0094.613] lstrlenW (lpString="|create|") returned 8 [0094.613] lstrlenW (lpString="|F|") returned 3 [0094.613] StrStrIW (lpFirst="|create|", lpSrch="|F|") returned 0x0 [0094.613] SetLastError (dwErrCode=0x490) [0094.613] lstrlenW (lpString="delete") returned 6 [0094.613] lstrlenW (lpString="delete") returned 6 [0094.613] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.613] lstrlenW (lpString="F") returned 1 [0094.613] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.613] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|delete|") returned 8 [0094.613] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|F|") returned 3 [0094.613] lstrlenW (lpString="|delete|") returned 8 [0094.613] lstrlenW (lpString="|F|") returned 3 [0094.613] StrStrIW (lpFirst="|delete|", lpSrch="|F|") returned 0x0 [0094.613] SetLastError (dwErrCode=0x490) [0094.613] lstrlenW (lpString="query") returned 5 [0094.613] lstrlenW (lpString="query") returned 5 [0094.613] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.613] lstrlenW (lpString="F") returned 1 [0094.613] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.613] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x8, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|query|") returned 7 [0094.613] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|F|") returned 3 [0094.613] lstrlenW (lpString="|query|") returned 7 [0094.613] lstrlenW (lpString="|F|") returned 3 [0094.613] StrStrIW (lpFirst="|query|", lpSrch="|F|") returned 0x0 [0094.613] SetLastError (dwErrCode=0x490) [0094.614] lstrlenW (lpString="change") returned 6 [0094.614] lstrlenW (lpString="change") returned 6 [0094.614] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.614] lstrlenW (lpString="F") returned 1 [0094.614] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.614] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|change|") returned 8 [0094.614] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|F|") returned 3 [0094.614] lstrlenW (lpString="|change|") returned 8 [0094.614] lstrlenW (lpString="|F|") returned 3 [0094.614] StrStrIW (lpFirst="|change|", lpSrch="|F|") returned 0x0 [0094.614] SetLastError (dwErrCode=0x490) [0094.614] lstrlenW (lpString="run") returned 3 [0094.614] lstrlenW (lpString="run") returned 3 [0094.614] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.614] lstrlenW (lpString="F") returned 1 [0094.614] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.614] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|run|") returned 5 [0094.614] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|F|") returned 3 [0094.614] lstrlenW (lpString="|run|") returned 5 [0094.614] lstrlenW (lpString="|F|") returned 3 [0094.614] StrStrIW (lpFirst="|run|", lpSrch="|F|") returned 0x0 [0094.614] SetLastError (dwErrCode=0x490) [0094.614] lstrlenW (lpString="end") returned 3 [0094.614] lstrlenW (lpString="end") returned 3 [0094.614] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.614] lstrlenW (lpString="F") returned 1 [0094.614] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.614] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|end|") returned 5 [0094.614] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|F|") returned 3 [0094.614] lstrlenW (lpString="|end|") returned 5 [0094.614] lstrlenW (lpString="|F|") returned 3 [0094.614] StrStrIW (lpFirst="|end|", lpSrch="|F|") returned 0x0 [0094.614] SetLastError (dwErrCode=0x490) [0094.614] lstrlenW (lpString="showsid") returned 7 [0094.614] lstrlenW (lpString="showsid") returned 7 [0094.614] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.614] lstrlenW (lpString="F") returned 1 [0094.614] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.614] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0xa, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|showsid|") returned 9 [0094.615] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16f640 | out: _Buffer="|F|") returned 3 [0094.615] lstrlenW (lpString="|showsid|") returned 9 [0094.615] lstrlenW (lpString="|F|") returned 3 [0094.615] StrStrIW (lpFirst="|showsid|", lpSrch="|F|") returned 0x0 [0094.615] SetLastError (dwErrCode=0x490) [0094.615] SetLastError (dwErrCode=0x490) [0094.615] SetLastError (dwErrCode=0x0) [0094.615] lstrlenW (lpString="/F") returned 2 [0094.615] StrChrIW (lpStart="/F", wMatch=0x3a) returned 0x0 [0094.615] SetLastError (dwErrCode=0x490) [0094.615] SetLastError (dwErrCode=0x0) [0094.615] lstrlenW (lpString="/F") returned 2 [0094.615] SetLastError (dwErrCode=0x0) [0094.617] SetLastError (dwErrCode=0x0) [0094.617] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0094.617] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0094.617] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0094.617] VerifyVersionInfoW (in: lpVersionInformation=0x16ca58, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x16ca58) returned 1 [0094.617] SetLastError (dwErrCode=0x0) [0094.617] lstrlenW (lpString="create") returned 6 [0094.617] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0094.617] SetLastError (dwErrCode=0x490) [0094.617] SetLastError (dwErrCode=0x0) [0094.617] lstrlenW (lpString="create") returned 6 [0094.617] _memicmp (_Buf1=0x1ce310, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.617] SetLastError (dwErrCode=0x0) [0094.617] _memicmp (_Buf1=0x1ce388, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.617] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d2ac0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0094.617] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\System32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0094.618] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\System32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1d2ff0 | out: lpData=0x1d2ff0) returned 1 [0094.618] VerQueryValueW (in: pBlock=0x1d2ff0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x16cb60, puLen=0x16cb64 | out: lplpBuffer=0x16cb60*=0x1d338c, puLen=0x16cb64) returned 1 [0094.618] _memicmp (_Buf1=0x1ce388, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.618] _vsnwprintf (in: _Buffer=0x1d2ac0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x16cb48 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0094.618] VerQueryValueW (in: pBlock=0x1d2ff0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x16cb70, puLen=0x16cb6c | out: lplpBuffer=0x16cb70*=0x1d31b8, puLen=0x16cb6c) returned 1 [0094.618] lstrlenW (lpString="schtasks.exe") returned 12 [0094.618] lstrlenW (lpString="schtasks.exe") returned 12 [0094.618] lstrlenW (lpString=".EXE") returned 4 [0094.618] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0094.618] lstrlenW (lpString="schtasks.exe") returned 12 [0094.618] lstrlenW (lpString=".EXE") returned 4 [0094.618] lstrlenW (lpString="schtasks") returned 8 [0094.618] lstrlenW (lpString="/create") returned 7 [0094.618] _memicmp (_Buf1=0x1ce388, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.618] _vsnwprintf (in: _Buffer=0x1d2ac0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x16cb48 | out: _Buffer="schtasks /create") returned 16 [0094.618] _memicmp (_Buf1=0x1ce3e8, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.618] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.618] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0094.618] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0094.618] _vsnwprintf (in: _Buffer=0x1d3748, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x16cb4c | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0094.618] SetLastError (dwErrCode=0x0) [0094.618] GetThreadLocale () returned 0x409 [0094.618] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.618] lstrlenW (lpString="create") returned 6 [0094.618] GetThreadLocale () returned 0x409 [0094.618] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.618] lstrlenW (lpString="?") returned 1 [0094.618] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="s") returned 1 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="u") returned 1 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="p") returned 1 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="ru") returned 2 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="rp") returned 2 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="sc") returned 2 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="mo") returned 2 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="d") returned 1 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="m") returned 1 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="i") returned 1 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="tn") returned 2 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="tr") returned 2 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="st") returned 2 [0094.619] GetThreadLocale () returned 0x409 [0094.619] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.619] lstrlenW (lpString="sd") returned 2 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="ed") returned 2 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="it") returned 2 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="et") returned 2 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="k") returned 1 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="du") returned 2 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="ri") returned 2 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="z") returned 1 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="f") returned 1 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="v1") returned 2 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="xml") returned 3 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="ec") returned 2 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="rl") returned 2 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="delay") returned 5 [0094.620] GetThreadLocale () returned 0x409 [0094.620] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0094.620] lstrlenW (lpString="np") returned 2 [0094.620] SetLastError (dwErrCode=0x0) [0094.621] SetLastError (dwErrCode=0x0) [0094.621] lstrlenW (lpString="/create") returned 7 [0094.621] lstrlenW (lpString="-/") returned 2 [0094.621] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.621] lstrlenW (lpString="create") returned 6 [0094.621] lstrlenW (lpString="create") returned 6 [0094.621] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.621] lstrlenW (lpString="create") returned 6 [0094.621] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.621] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|create|") returned 8 [0094.621] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|create|") returned 8 [0094.621] lstrlenW (lpString="|create|") returned 8 [0094.621] lstrlenW (lpString="|create|") returned 8 [0094.621] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0094.621] SetLastError (dwErrCode=0x0) [0094.621] SetLastError (dwErrCode=0x0) [0094.621] SetLastError (dwErrCode=0x0) [0094.621] lstrlenW (lpString="/tn") returned 3 [0094.621] lstrlenW (lpString="-/") returned 2 [0094.621] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.621] lstrlenW (lpString="create") returned 6 [0094.621] lstrlenW (lpString="create") returned 6 [0094.621] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.621] lstrlenW (lpString="tn") returned 2 [0094.621] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.621] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|create|") returned 8 [0094.621] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.621] lstrlenW (lpString="|create|") returned 8 [0094.621] lstrlenW (lpString="|tn|") returned 4 [0094.621] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0094.621] SetLastError (dwErrCode=0x490) [0094.621] lstrlenW (lpString="?") returned 1 [0094.621] lstrlenW (lpString="?") returned 1 [0094.621] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.621] lstrlenW (lpString="tn") returned 2 [0094.621] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.621] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|?|") returned 3 [0094.621] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.621] lstrlenW (lpString="|?|") returned 3 [0094.621] lstrlenW (lpString="|tn|") returned 4 [0094.622] SetLastError (dwErrCode=0x490) [0094.622] lstrlenW (lpString="s") returned 1 [0094.622] lstrlenW (lpString="s") returned 1 [0094.622] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.622] lstrlenW (lpString="tn") returned 2 [0094.622] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.622] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|s|") returned 3 [0094.622] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.622] lstrlenW (lpString="|s|") returned 3 [0094.622] lstrlenW (lpString="|tn|") returned 4 [0094.622] SetLastError (dwErrCode=0x490) [0094.622] lstrlenW (lpString="u") returned 1 [0094.622] lstrlenW (lpString="u") returned 1 [0094.622] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.622] lstrlenW (lpString="tn") returned 2 [0094.622] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.622] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|u|") returned 3 [0094.622] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.622] lstrlenW (lpString="|u|") returned 3 [0094.622] lstrlenW (lpString="|tn|") returned 4 [0094.622] SetLastError (dwErrCode=0x490) [0094.622] lstrlenW (lpString="p") returned 1 [0094.622] lstrlenW (lpString="p") returned 1 [0094.622] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.622] lstrlenW (lpString="tn") returned 2 [0094.622] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.622] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|p|") returned 3 [0094.622] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.622] lstrlenW (lpString="|p|") returned 3 [0094.622] lstrlenW (lpString="|tn|") returned 4 [0094.622] SetLastError (dwErrCode=0x490) [0094.622] lstrlenW (lpString="ru") returned 2 [0094.622] lstrlenW (lpString="ru") returned 2 [0094.622] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.622] lstrlenW (lpString="tn") returned 2 [0094.622] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.622] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|ru|") returned 4 [0094.622] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.622] lstrlenW (lpString="|ru|") returned 4 [0094.623] lstrlenW (lpString="|tn|") returned 4 [0094.623] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0094.623] SetLastError (dwErrCode=0x490) [0094.623] lstrlenW (lpString="rp") returned 2 [0094.623] lstrlenW (lpString="rp") returned 2 [0094.623] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.623] lstrlenW (lpString="tn") returned 2 [0094.623] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.623] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|rp|") returned 4 [0094.623] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.623] lstrlenW (lpString="|rp|") returned 4 [0094.623] lstrlenW (lpString="|tn|") returned 4 [0094.623] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0094.623] SetLastError (dwErrCode=0x490) [0094.623] lstrlenW (lpString="sc") returned 2 [0094.623] lstrlenW (lpString="sc") returned 2 [0094.623] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.623] lstrlenW (lpString="tn") returned 2 [0094.623] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.623] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.623] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.623] lstrlenW (lpString="|sc|") returned 4 [0094.623] lstrlenW (lpString="|tn|") returned 4 [0094.623] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0094.623] SetLastError (dwErrCode=0x490) [0094.623] lstrlenW (lpString="mo") returned 2 [0094.623] lstrlenW (lpString="mo") returned 2 [0094.623] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.623] lstrlenW (lpString="tn") returned 2 [0094.623] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.623] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.623] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.623] lstrlenW (lpString="|mo|") returned 4 [0094.623] lstrlenW (lpString="|tn|") returned 4 [0094.623] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0094.623] SetLastError (dwErrCode=0x490) [0094.623] lstrlenW (lpString="d") returned 1 [0094.623] lstrlenW (lpString="d") returned 1 [0094.624] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.624] lstrlenW (lpString="tn") returned 2 [0094.624] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.624] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|d|") returned 3 [0094.624] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.624] lstrlenW (lpString="|d|") returned 3 [0094.624] lstrlenW (lpString="|tn|") returned 4 [0094.624] SetLastError (dwErrCode=0x490) [0094.624] lstrlenW (lpString="m") returned 1 [0094.624] lstrlenW (lpString="m") returned 1 [0094.624] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.624] lstrlenW (lpString="tn") returned 2 [0094.624] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.624] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|m|") returned 3 [0094.624] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.624] lstrlenW (lpString="|m|") returned 3 [0094.624] lstrlenW (lpString="|tn|") returned 4 [0094.624] SetLastError (dwErrCode=0x490) [0094.624] lstrlenW (lpString="i") returned 1 [0094.624] lstrlenW (lpString="i") returned 1 [0094.624] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.624] lstrlenW (lpString="tn") returned 2 [0094.624] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.624] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|i|") returned 3 [0094.624] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.624] lstrlenW (lpString="|i|") returned 3 [0094.624] lstrlenW (lpString="|tn|") returned 4 [0094.624] SetLastError (dwErrCode=0x490) [0094.624] lstrlenW (lpString="tn") returned 2 [0094.624] lstrlenW (lpString="tn") returned 2 [0094.624] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.624] lstrlenW (lpString="tn") returned 2 [0094.624] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.624] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.624] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.625] lstrlenW (lpString="|tn|") returned 4 [0094.625] lstrlenW (lpString="|tn|") returned 4 [0094.625] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0094.625] SetLastError (dwErrCode=0x0) [0094.625] SetLastError (dwErrCode=0x0) [0094.625] lstrlenW (lpString="RtkAudioService64") returned 17 [0094.625] lstrlenW (lpString="-/") returned 2 [0094.625] StrChrIW (lpStart="-/", wMatch=0x52) returned 0x0 [0094.625] SetLastError (dwErrCode=0x490) [0094.625] SetLastError (dwErrCode=0x490) [0094.625] SetLastError (dwErrCode=0x0) [0094.625] lstrlenW (lpString="RtkAudioService64") returned 17 [0094.625] StrChrIW (lpStart="RtkAudioService64", wMatch=0x3a) returned 0x0 [0094.625] SetLastError (dwErrCode=0x490) [0094.625] SetLastError (dwErrCode=0x0) [0094.625] lstrlenW (lpString="RtkAudioService64") returned 17 [0094.625] SetLastError (dwErrCode=0x0) [0094.625] SetLastError (dwErrCode=0x0) [0094.625] lstrlenW (lpString="/tr") returned 3 [0094.625] lstrlenW (lpString="-/") returned 2 [0094.625] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.625] lstrlenW (lpString="create") returned 6 [0094.625] lstrlenW (lpString="create") returned 6 [0094.625] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.625] lstrlenW (lpString="tr") returned 2 [0094.625] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.625] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|create|") returned 8 [0094.625] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.625] lstrlenW (lpString="|create|") returned 8 [0094.625] lstrlenW (lpString="|tr|") returned 4 [0094.625] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0094.625] SetLastError (dwErrCode=0x490) [0094.625] lstrlenW (lpString="?") returned 1 [0094.625] lstrlenW (lpString="?") returned 1 [0094.625] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.625] lstrlenW (lpString="tr") returned 2 [0094.625] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.625] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|?|") returned 3 [0094.625] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.625] lstrlenW (lpString="|?|") returned 3 [0094.625] lstrlenW (lpString="|tr|") returned 4 [0094.625] SetLastError (dwErrCode=0x490) [0094.626] lstrlenW (lpString="s") returned 1 [0094.626] lstrlenW (lpString="s") returned 1 [0094.626] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.626] lstrlenW (lpString="tr") returned 2 [0094.626] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.626] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|s|") returned 3 [0094.626] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.626] lstrlenW (lpString="|s|") returned 3 [0094.626] lstrlenW (lpString="|tr|") returned 4 [0094.626] SetLastError (dwErrCode=0x490) [0094.626] lstrlenW (lpString="u") returned 1 [0094.626] lstrlenW (lpString="u") returned 1 [0094.626] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.626] lstrlenW (lpString="tr") returned 2 [0094.626] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.626] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|u|") returned 3 [0094.626] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.626] lstrlenW (lpString="|u|") returned 3 [0094.626] lstrlenW (lpString="|tr|") returned 4 [0094.626] SetLastError (dwErrCode=0x490) [0094.626] lstrlenW (lpString="p") returned 1 [0094.626] lstrlenW (lpString="p") returned 1 [0094.626] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.626] lstrlenW (lpString="tr") returned 2 [0094.626] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.626] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|p|") returned 3 [0094.626] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.626] lstrlenW (lpString="|p|") returned 3 [0094.626] lstrlenW (lpString="|tr|") returned 4 [0094.626] SetLastError (dwErrCode=0x490) [0094.626] lstrlenW (lpString="ru") returned 2 [0094.626] lstrlenW (lpString="ru") returned 2 [0094.626] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.626] lstrlenW (lpString="tr") returned 2 [0094.626] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.626] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|ru|") returned 4 [0094.626] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.626] lstrlenW (lpString="|ru|") returned 4 [0094.626] lstrlenW (lpString="|tr|") returned 4 [0094.627] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0094.627] SetLastError (dwErrCode=0x490) [0094.627] lstrlenW (lpString="rp") returned 2 [0094.627] lstrlenW (lpString="rp") returned 2 [0094.627] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.627] lstrlenW (lpString="tr") returned 2 [0094.627] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.627] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|rp|") returned 4 [0094.627] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.627] lstrlenW (lpString="|rp|") returned 4 [0094.627] lstrlenW (lpString="|tr|") returned 4 [0094.627] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0094.627] SetLastError (dwErrCode=0x490) [0094.627] lstrlenW (lpString="sc") returned 2 [0094.627] lstrlenW (lpString="sc") returned 2 [0094.627] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.627] lstrlenW (lpString="tr") returned 2 [0094.627] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.627] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.627] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.627] lstrlenW (lpString="|sc|") returned 4 [0094.627] lstrlenW (lpString="|tr|") returned 4 [0094.627] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0094.627] SetLastError (dwErrCode=0x490) [0094.627] lstrlenW (lpString="mo") returned 2 [0094.627] lstrlenW (lpString="mo") returned 2 [0094.627] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.627] lstrlenW (lpString="tr") returned 2 [0094.627] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.627] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.627] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.627] lstrlenW (lpString="|mo|") returned 4 [0094.627] lstrlenW (lpString="|tr|") returned 4 [0094.627] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0094.627] SetLastError (dwErrCode=0x490) [0094.627] lstrlenW (lpString="d") returned 1 [0094.627] lstrlenW (lpString="d") returned 1 [0094.627] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.628] lstrlenW (lpString="tr") returned 2 [0094.628] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.628] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|d|") returned 3 [0094.628] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.628] lstrlenW (lpString="|d|") returned 3 [0094.628] lstrlenW (lpString="|tr|") returned 4 [0094.628] SetLastError (dwErrCode=0x490) [0094.628] lstrlenW (lpString="m") returned 1 [0094.628] lstrlenW (lpString="m") returned 1 [0094.628] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.628] lstrlenW (lpString="tr") returned 2 [0094.628] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.628] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|m|") returned 3 [0094.628] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.628] lstrlenW (lpString="|m|") returned 3 [0094.628] lstrlenW (lpString="|tr|") returned 4 [0094.628] SetLastError (dwErrCode=0x490) [0094.628] lstrlenW (lpString="i") returned 1 [0094.628] lstrlenW (lpString="i") returned 1 [0094.628] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.628] lstrlenW (lpString="tr") returned 2 [0094.628] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.628] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|i|") returned 3 [0094.628] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.628] lstrlenW (lpString="|i|") returned 3 [0094.628] lstrlenW (lpString="|tr|") returned 4 [0094.628] SetLastError (dwErrCode=0x490) [0094.628] lstrlenW (lpString="tn") returned 2 [0094.628] lstrlenW (lpString="tn") returned 2 [0094.628] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.628] lstrlenW (lpString="tr") returned 2 [0094.628] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.628] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.628] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.628] lstrlenW (lpString="|tn|") returned 4 [0094.628] lstrlenW (lpString="|tr|") returned 4 [0094.628] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0094.628] SetLastError (dwErrCode=0x490) [0094.628] lstrlenW (lpString="tr") returned 2 [0094.629] lstrlenW (lpString="tr") returned 2 [0094.629] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.629] lstrlenW (lpString="tr") returned 2 [0094.629] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.629] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.629] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.629] lstrlenW (lpString="|tr|") returned 4 [0094.629] lstrlenW (lpString="|tr|") returned 4 [0094.629] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0094.629] SetLastError (dwErrCode=0x0) [0094.629] SetLastError (dwErrCode=0x0) [0094.629] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.629] lstrlenW (lpString="-/") returned 2 [0094.629] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0094.629] SetLastError (dwErrCode=0x490) [0094.629] SetLastError (dwErrCode=0x490) [0094.629] SetLastError (dwErrCode=0x0) [0094.629] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.629] StrChrIW (lpStart="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", wMatch=0x3a) returned=":\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" [0094.629] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.629] _memicmp (_Buf1=0x1ce430, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.629] _memicmp (_Buf1=0x1ce478, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.629] SetLastError (dwErrCode=0x7a) [0094.629] SetLastError (dwErrCode=0x0) [0094.629] SetLastError (dwErrCode=0x0) [0094.629] lstrlenW (lpString="C") returned 1 [0094.629] SetLastError (dwErrCode=0x490) [0094.629] SetLastError (dwErrCode=0x0) [0094.629] _memicmp (_Buf1=0x1ce490, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.629] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.629] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.629] lstrlenW (lpString=" \x09") returned 2 [0094.629] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0094.629] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0094.629] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0094.629] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.629] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0094.629] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0094.629] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x4a) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0094.630] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.631] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0094.631] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.631] GetLastError () returned 0x0 [0094.631] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.631] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0094.631] SetLastError (dwErrCode=0x0) [0094.631] SetLastError (dwErrCode=0x0) [0094.631] lstrlenW (lpString="/sc") returned 3 [0094.631] lstrlenW (lpString="-/") returned 2 [0094.631] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.631] lstrlenW (lpString="create") returned 6 [0094.631] lstrlenW (lpString="create") returned 6 [0094.631] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.631] lstrlenW (lpString="sc") returned 2 [0094.631] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.631] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|create|") returned 8 [0094.631] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.631] lstrlenW (lpString="|create|") returned 8 [0094.631] lstrlenW (lpString="|sc|") returned 4 [0094.631] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0094.631] SetLastError (dwErrCode=0x490) [0094.631] lstrlenW (lpString="?") returned 1 [0094.631] lstrlenW (lpString="?") returned 1 [0094.631] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.631] lstrlenW (lpString="sc") returned 2 [0094.631] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.631] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|?|") returned 3 [0094.631] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.631] lstrlenW (lpString="|?|") returned 3 [0094.631] lstrlenW (lpString="|sc|") returned 4 [0094.631] SetLastError (dwErrCode=0x490) [0094.631] lstrlenW (lpString="s") returned 1 [0094.631] lstrlenW (lpString="s") returned 1 [0094.631] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.631] lstrlenW (lpString="sc") returned 2 [0094.631] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.631] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|s|") returned 3 [0094.631] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.632] lstrlenW (lpString="|s|") returned 3 [0094.632] lstrlenW (lpString="|sc|") returned 4 [0094.632] SetLastError (dwErrCode=0x490) [0094.632] lstrlenW (lpString="u") returned 1 [0094.632] lstrlenW (lpString="u") returned 1 [0094.632] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.632] lstrlenW (lpString="sc") returned 2 [0094.632] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.632] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|u|") returned 3 [0094.632] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.632] lstrlenW (lpString="|u|") returned 3 [0094.632] lstrlenW (lpString="|sc|") returned 4 [0094.632] SetLastError (dwErrCode=0x490) [0094.632] lstrlenW (lpString="p") returned 1 [0094.632] lstrlenW (lpString="p") returned 1 [0094.632] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.632] lstrlenW (lpString="sc") returned 2 [0094.632] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.632] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|p|") returned 3 [0094.632] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.632] lstrlenW (lpString="|p|") returned 3 [0094.632] lstrlenW (lpString="|sc|") returned 4 [0094.632] SetLastError (dwErrCode=0x490) [0094.632] lstrlenW (lpString="ru") returned 2 [0094.632] lstrlenW (lpString="ru") returned 2 [0094.632] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.632] lstrlenW (lpString="sc") returned 2 [0094.632] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.632] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|ru|") returned 4 [0094.632] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.632] lstrlenW (lpString="|ru|") returned 4 [0094.632] lstrlenW (lpString="|sc|") returned 4 [0094.632] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0094.632] SetLastError (dwErrCode=0x490) [0094.632] lstrlenW (lpString="rp") returned 2 [0094.632] lstrlenW (lpString="rp") returned 2 [0094.632] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.632] lstrlenW (lpString="sc") returned 2 [0094.632] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.633] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|rp|") returned 4 [0094.633] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.633] lstrlenW (lpString="|rp|") returned 4 [0094.633] lstrlenW (lpString="|sc|") returned 4 [0094.633] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0094.633] SetLastError (dwErrCode=0x490) [0094.633] lstrlenW (lpString="sc") returned 2 [0094.633] lstrlenW (lpString="sc") returned 2 [0094.633] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.633] lstrlenW (lpString="sc") returned 2 [0094.633] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.633] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.633] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.633] lstrlenW (lpString="|sc|") returned 4 [0094.633] lstrlenW (lpString="|sc|") returned 4 [0094.633] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0094.633] SetLastError (dwErrCode=0x0) [0094.633] SetLastError (dwErrCode=0x0) [0094.633] lstrlenW (lpString="minute") returned 6 [0094.633] lstrlenW (lpString="-/") returned 2 [0094.633] StrChrIW (lpStart="-/", wMatch=0x6d) returned 0x0 [0094.633] SetLastError (dwErrCode=0x490) [0094.633] SetLastError (dwErrCode=0x490) [0094.633] SetLastError (dwErrCode=0x0) [0094.633] lstrlenW (lpString="minute") returned 6 [0094.633] StrChrIW (lpStart="minute", wMatch=0x3a) returned 0x0 [0094.633] SetLastError (dwErrCode=0x490) [0094.633] SetLastError (dwErrCode=0x0) [0094.633] _memicmp (_Buf1=0x1ce490, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.633] lstrlenW (lpString="minute") returned 6 [0094.633] lstrlenW (lpString="minute") returned 6 [0094.633] lstrlenW (lpString=" \x09") returned 2 [0094.633] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0094.633] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0094.633] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0094.633] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0094.633] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0094.633] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0094.633] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0094.633] GetLastError () returned 0x0 [0094.633] lstrlenW (lpString="minute") returned 6 [0094.633] lstrlenW (lpString="minute") returned 6 [0094.633] SetLastError (dwErrCode=0x0) [0094.634] SetLastError (dwErrCode=0x0) [0094.634] lstrlenW (lpString="/mo") returned 3 [0094.634] lstrlenW (lpString="-/") returned 2 [0094.634] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.634] lstrlenW (lpString="create") returned 6 [0094.634] lstrlenW (lpString="create") returned 6 [0094.634] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.634] lstrlenW (lpString="mo") returned 2 [0094.634] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.634] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|create|") returned 8 [0094.634] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.634] lstrlenW (lpString="|create|") returned 8 [0094.634] lstrlenW (lpString="|mo|") returned 4 [0094.634] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0094.634] SetLastError (dwErrCode=0x490) [0094.634] lstrlenW (lpString="?") returned 1 [0094.634] lstrlenW (lpString="?") returned 1 [0094.634] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.634] lstrlenW (lpString="mo") returned 2 [0094.634] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.634] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|?|") returned 3 [0094.634] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.634] lstrlenW (lpString="|?|") returned 3 [0094.634] lstrlenW (lpString="|mo|") returned 4 [0094.634] SetLastError (dwErrCode=0x490) [0094.634] lstrlenW (lpString="s") returned 1 [0094.634] lstrlenW (lpString="s") returned 1 [0094.634] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.634] lstrlenW (lpString="mo") returned 2 [0094.634] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.634] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|s|") returned 3 [0094.634] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.634] lstrlenW (lpString="|s|") returned 3 [0094.634] lstrlenW (lpString="|mo|") returned 4 [0094.634] SetLastError (dwErrCode=0x490) [0094.634] lstrlenW (lpString="u") returned 1 [0094.634] lstrlenW (lpString="u") returned 1 [0094.634] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.634] lstrlenW (lpString="mo") returned 2 [0094.634] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.635] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|u|") returned 3 [0094.635] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.635] lstrlenW (lpString="|u|") returned 3 [0094.635] lstrlenW (lpString="|mo|") returned 4 [0094.635] SetLastError (dwErrCode=0x490) [0094.635] lstrlenW (lpString="p") returned 1 [0094.635] lstrlenW (lpString="p") returned 1 [0094.635] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.635] lstrlenW (lpString="mo") returned 2 [0094.635] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.635] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|p|") returned 3 [0094.635] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.635] lstrlenW (lpString="|p|") returned 3 [0094.635] lstrlenW (lpString="|mo|") returned 4 [0094.635] SetLastError (dwErrCode=0x490) [0094.635] lstrlenW (lpString="ru") returned 2 [0094.635] lstrlenW (lpString="ru") returned 2 [0094.635] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.635] lstrlenW (lpString="mo") returned 2 [0094.635] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.635] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|ru|") returned 4 [0094.635] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.635] lstrlenW (lpString="|ru|") returned 4 [0094.635] lstrlenW (lpString="|mo|") returned 4 [0094.635] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0094.635] SetLastError (dwErrCode=0x490) [0094.635] lstrlenW (lpString="rp") returned 2 [0094.635] lstrlenW (lpString="rp") returned 2 [0094.635] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.635] lstrlenW (lpString="mo") returned 2 [0094.635] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.635] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|rp|") returned 4 [0094.635] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.635] lstrlenW (lpString="|rp|") returned 4 [0094.635] lstrlenW (lpString="|mo|") returned 4 [0094.635] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0094.635] SetLastError (dwErrCode=0x490) [0094.635] lstrlenW (lpString="sc") returned 2 [0094.636] lstrlenW (lpString="sc") returned 2 [0094.636] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.636] lstrlenW (lpString="mo") returned 2 [0094.636] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.636] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.636] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.636] lstrlenW (lpString="|sc|") returned 4 [0094.636] lstrlenW (lpString="|mo|") returned 4 [0094.636] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0094.636] SetLastError (dwErrCode=0x490) [0094.636] lstrlenW (lpString="mo") returned 2 [0094.636] lstrlenW (lpString="mo") returned 2 [0094.636] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.636] lstrlenW (lpString="mo") returned 2 [0094.636] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.636] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.636] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.636] lstrlenW (lpString="|mo|") returned 4 [0094.636] lstrlenW (lpString="|mo|") returned 4 [0094.636] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0094.636] SetLastError (dwErrCode=0x0) [0094.636] SetLastError (dwErrCode=0x0) [0094.636] lstrlenW (lpString="1") returned 1 [0094.636] SetLastError (dwErrCode=0x490) [0094.636] SetLastError (dwErrCode=0x0) [0094.636] lstrlenW (lpString="1") returned 1 [0094.636] StrChrIW (lpStart="1", wMatch=0x3a) returned 0x0 [0094.636] SetLastError (dwErrCode=0x490) [0094.636] SetLastError (dwErrCode=0x0) [0094.636] _memicmp (_Buf1=0x1ce490, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.636] lstrlenW (lpString="1") returned 1 [0094.636] lstrlenW (lpString="1") returned 1 [0094.636] lstrlenW (lpString=" \x09") returned 2 [0094.636] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0094.636] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0094.636] GetLastError () returned 0x0 [0094.636] lstrlenW (lpString="1") returned 1 [0094.636] lstrlenW (lpString="1") returned 1 [0094.636] SetLastError (dwErrCode=0x0) [0094.636] SetLastError (dwErrCode=0x0) [0094.636] lstrlenW (lpString="/F") returned 2 [0094.637] lstrlenW (lpString="-/") returned 2 [0094.637] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0094.637] lstrlenW (lpString="create") returned 6 [0094.637] lstrlenW (lpString="create") returned 6 [0094.637] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.637] lstrlenW (lpString="F") returned 1 [0094.637] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.637] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|create|") returned 8 [0094.637] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.637] lstrlenW (lpString="|create|") returned 8 [0094.637] lstrlenW (lpString="|F|") returned 3 [0094.637] StrStrIW (lpFirst="|create|", lpSrch="|F|") returned 0x0 [0094.637] SetLastError (dwErrCode=0x490) [0094.637] lstrlenW (lpString="?") returned 1 [0094.637] lstrlenW (lpString="?") returned 1 [0094.637] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.637] lstrlenW (lpString="F") returned 1 [0094.637] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.637] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|?|") returned 3 [0094.637] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.637] lstrlenW (lpString="|?|") returned 3 [0094.637] lstrlenW (lpString="|F|") returned 3 [0094.637] StrStrIW (lpFirst="|?|", lpSrch="|F|") returned 0x0 [0094.637] SetLastError (dwErrCode=0x490) [0094.637] lstrlenW (lpString="s") returned 1 [0094.637] lstrlenW (lpString="s") returned 1 [0094.637] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.637] lstrlenW (lpString="F") returned 1 [0094.637] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.637] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|s|") returned 3 [0094.637] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.637] lstrlenW (lpString="|s|") returned 3 [0094.637] lstrlenW (lpString="|F|") returned 3 [0094.637] StrStrIW (lpFirst="|s|", lpSrch="|F|") returned 0x0 [0094.637] SetLastError (dwErrCode=0x490) [0094.637] lstrlenW (lpString="u") returned 1 [0094.637] lstrlenW (lpString="u") returned 1 [0094.637] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.637] lstrlenW (lpString="F") returned 1 [0094.638] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.638] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|u|") returned 3 [0094.638] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.638] lstrlenW (lpString="|u|") returned 3 [0094.638] lstrlenW (lpString="|F|") returned 3 [0094.638] StrStrIW (lpFirst="|u|", lpSrch="|F|") returned 0x0 [0094.638] SetLastError (dwErrCode=0x490) [0094.638] lstrlenW (lpString="p") returned 1 [0094.638] lstrlenW (lpString="p") returned 1 [0094.638] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.638] lstrlenW (lpString="F") returned 1 [0094.638] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.638] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|p|") returned 3 [0094.638] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.638] lstrlenW (lpString="|p|") returned 3 [0094.638] lstrlenW (lpString="|F|") returned 3 [0094.638] StrStrIW (lpFirst="|p|", lpSrch="|F|") returned 0x0 [0094.638] SetLastError (dwErrCode=0x490) [0094.638] lstrlenW (lpString="ru") returned 2 [0094.638] lstrlenW (lpString="ru") returned 2 [0094.638] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.638] lstrlenW (lpString="F") returned 1 [0094.638] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.638] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|ru|") returned 4 [0094.638] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.638] lstrlenW (lpString="|ru|") returned 4 [0094.638] lstrlenW (lpString="|F|") returned 3 [0094.638] StrStrIW (lpFirst="|ru|", lpSrch="|F|") returned 0x0 [0094.638] SetLastError (dwErrCode=0x490) [0094.638] lstrlenW (lpString="rp") returned 2 [0094.638] lstrlenW (lpString="rp") returned 2 [0094.638] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.638] lstrlenW (lpString="F") returned 1 [0094.638] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.638] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|rp|") returned 4 [0094.638] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.638] lstrlenW (lpString="|rp|") returned 4 [0094.638] lstrlenW (lpString="|F|") returned 3 [0094.638] StrStrIW (lpFirst="|rp|", lpSrch="|F|") returned 0x0 [0094.639] SetLastError (dwErrCode=0x490) [0094.639] lstrlenW (lpString="sc") returned 2 [0094.639] lstrlenW (lpString="sc") returned 2 [0094.639] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.639] lstrlenW (lpString="F") returned 1 [0094.639] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.639] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sc|") returned 4 [0094.639] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.639] lstrlenW (lpString="|sc|") returned 4 [0094.639] lstrlenW (lpString="|F|") returned 3 [0094.639] StrStrIW (lpFirst="|sc|", lpSrch="|F|") returned 0x0 [0094.639] SetLastError (dwErrCode=0x490) [0094.639] lstrlenW (lpString="mo") returned 2 [0094.639] lstrlenW (lpString="mo") returned 2 [0094.639] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.639] lstrlenW (lpString="F") returned 1 [0094.639] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.639] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|mo|") returned 4 [0094.639] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.639] lstrlenW (lpString="|mo|") returned 4 [0094.639] lstrlenW (lpString="|F|") returned 3 [0094.639] StrStrIW (lpFirst="|mo|", lpSrch="|F|") returned 0x0 [0094.639] SetLastError (dwErrCode=0x490) [0094.639] lstrlenW (lpString="d") returned 1 [0094.639] lstrlenW (lpString="d") returned 1 [0094.639] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.639] lstrlenW (lpString="F") returned 1 [0094.639] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.639] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|d|") returned 3 [0094.639] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.639] lstrlenW (lpString="|d|") returned 3 [0094.639] lstrlenW (lpString="|F|") returned 3 [0094.639] StrStrIW (lpFirst="|d|", lpSrch="|F|") returned 0x0 [0094.686] SetLastError (dwErrCode=0x490) [0094.686] lstrlenW (lpString="m") returned 1 [0094.686] lstrlenW (lpString="m") returned 1 [0094.686] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.686] lstrlenW (lpString="F") returned 1 [0094.686] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.687] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|m|") returned 3 [0094.687] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.687] lstrlenW (lpString="|m|") returned 3 [0094.687] lstrlenW (lpString="|F|") returned 3 [0094.687] StrStrIW (lpFirst="|m|", lpSrch="|F|") returned 0x0 [0094.687] SetLastError (dwErrCode=0x490) [0094.687] lstrlenW (lpString="i") returned 1 [0094.687] lstrlenW (lpString="i") returned 1 [0094.687] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.687] lstrlenW (lpString="F") returned 1 [0094.687] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.687] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|i|") returned 3 [0094.687] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.687] lstrlenW (lpString="|i|") returned 3 [0094.687] lstrlenW (lpString="|F|") returned 3 [0094.687] StrStrIW (lpFirst="|i|", lpSrch="|F|") returned 0x0 [0094.687] SetLastError (dwErrCode=0x490) [0094.687] lstrlenW (lpString="tn") returned 2 [0094.687] lstrlenW (lpString="tn") returned 2 [0094.687] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.687] lstrlenW (lpString="F") returned 1 [0094.687] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.687] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tn|") returned 4 [0094.687] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.687] lstrlenW (lpString="|tn|") returned 4 [0094.687] lstrlenW (lpString="|F|") returned 3 [0094.687] StrStrIW (lpFirst="|tn|", lpSrch="|F|") returned 0x0 [0094.687] SetLastError (dwErrCode=0x490) [0094.687] lstrlenW (lpString="tr") returned 2 [0094.687] lstrlenW (lpString="tr") returned 2 [0094.687] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.687] lstrlenW (lpString="F") returned 1 [0094.687] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.687] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|tr|") returned 4 [0094.687] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.687] lstrlenW (lpString="|tr|") returned 4 [0094.687] lstrlenW (lpString="|F|") returned 3 [0094.688] StrStrIW (lpFirst="|tr|", lpSrch="|F|") returned 0x0 [0094.688] SetLastError (dwErrCode=0x490) [0094.688] lstrlenW (lpString="st") returned 2 [0094.688] lstrlenW (lpString="st") returned 2 [0094.688] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.688] lstrlenW (lpString="F") returned 1 [0094.688] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.688] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|st|") returned 4 [0094.688] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.688] lstrlenW (lpString="|st|") returned 4 [0094.688] lstrlenW (lpString="|F|") returned 3 [0094.688] StrStrIW (lpFirst="|st|", lpSrch="|F|") returned 0x0 [0094.688] SetLastError (dwErrCode=0x490) [0094.688] lstrlenW (lpString="sd") returned 2 [0094.688] lstrlenW (lpString="sd") returned 2 [0094.688] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.688] lstrlenW (lpString="F") returned 1 [0094.688] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.688] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|sd|") returned 4 [0094.688] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.688] lstrlenW (lpString="|sd|") returned 4 [0094.688] lstrlenW (lpString="|F|") returned 3 [0094.688] StrStrIW (lpFirst="|sd|", lpSrch="|F|") returned 0x0 [0094.688] SetLastError (dwErrCode=0x490) [0094.688] lstrlenW (lpString="ed") returned 2 [0094.688] lstrlenW (lpString="ed") returned 2 [0094.688] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.688] lstrlenW (lpString="F") returned 1 [0094.688] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.688] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|ed|") returned 4 [0094.688] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.688] lstrlenW (lpString="|ed|") returned 4 [0094.688] lstrlenW (lpString="|F|") returned 3 [0094.688] StrStrIW (lpFirst="|ed|", lpSrch="|F|") returned 0x0 [0094.688] SetLastError (dwErrCode=0x490) [0094.688] lstrlenW (lpString="it") returned 2 [0094.688] lstrlenW (lpString="it") returned 2 [0094.688] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.689] lstrlenW (lpString="F") returned 1 [0094.689] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.689] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|it|") returned 4 [0094.689] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.689] lstrlenW (lpString="|it|") returned 4 [0094.689] lstrlenW (lpString="|F|") returned 3 [0094.689] StrStrIW (lpFirst="|it|", lpSrch="|F|") returned 0x0 [0094.689] SetLastError (dwErrCode=0x490) [0094.689] lstrlenW (lpString="et") returned 2 [0094.689] lstrlenW (lpString="et") returned 2 [0094.689] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.689] lstrlenW (lpString="F") returned 1 [0094.689] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.689] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|et|") returned 4 [0094.689] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.689] lstrlenW (lpString="|et|") returned 4 [0094.689] lstrlenW (lpString="|F|") returned 3 [0094.689] StrStrIW (lpFirst="|et|", lpSrch="|F|") returned 0x0 [0094.689] SetLastError (dwErrCode=0x490) [0094.689] lstrlenW (lpString="k") returned 1 [0094.689] lstrlenW (lpString="k") returned 1 [0094.689] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.689] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.689] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|k|") returned 3 [0094.689] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.689] lstrlenW (lpString="|k|") returned 3 [0094.689] lstrlenW (lpString="|F|") returned 3 [0094.689] StrStrIW (lpFirst="|k|", lpSrch="|F|") returned 0x0 [0094.689] SetLastError (dwErrCode=0x490) [0094.689] lstrlenW (lpString="du") returned 2 [0094.690] lstrlenW (lpString="du") returned 2 [0094.690] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.690] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.690] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|du|") returned 4 [0094.690] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.690] lstrlenW (lpString="|du|") returned 4 [0094.690] lstrlenW (lpString="|F|") returned 3 [0094.690] StrStrIW (lpFirst="|du|", lpSrch="|F|") returned 0x0 [0094.690] SetLastError (dwErrCode=0x490) [0094.690] lstrlenW (lpString="ri") returned 2 [0094.690] lstrlenW (lpString="ri") returned 2 [0094.690] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.690] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.690] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|ri|") returned 4 [0094.690] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.690] lstrlenW (lpString="|ri|") returned 4 [0094.690] lstrlenW (lpString="|F|") returned 3 [0094.690] StrStrIW (lpFirst="|ri|", lpSrch="|F|") returned 0x0 [0094.690] SetLastError (dwErrCode=0x490) [0094.690] lstrlenW (lpString="z") returned 1 [0094.690] lstrlenW (lpString="z") returned 1 [0094.690] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.690] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.690] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|z|") returned 3 [0094.691] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.691] lstrlenW (lpString="|z|") returned 3 [0094.691] lstrlenW (lpString="|F|") returned 3 [0094.691] StrStrIW (lpFirst="|z|", lpSrch="|F|") returned 0x0 [0094.691] SetLastError (dwErrCode=0x490) [0094.691] lstrlenW (lpString="f") returned 1 [0094.691] lstrlenW (lpString="f") returned 1 [0094.691] _memicmp (_Buf1=0x1ce418, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.691] _memicmp (_Buf1=0x1ce448, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.691] _vsnwprintf (in: _Buffer=0x1d2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|f|") returned 3 [0094.691] _vsnwprintf (in: _Buffer=0x1d2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0x16cb34 | out: _Buffer="|F|") returned 3 [0094.691] lstrlenW (lpString="|f|") returned 3 [0094.691] lstrlenW (lpString="|F|") returned 3 [0094.691] StrStrIW (lpFirst="|f|", lpSrch="|F|") returned="|f|" [0094.691] SetLastError (dwErrCode=0x0) [0094.691] SetLastError (dwErrCode=0x0) [0094.691] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.691] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0094.691] lstrlenW (lpString="MINUTE") returned 6 [0094.691] GetThreadLocale () returned 0x409 [0094.691] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="minute", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0094.692] SetLastError (dwErrCode=0x0) [0094.692] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.692] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0094.692] lstrlenW (lpString="First") returned 5 [0094.692] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.692] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0094.692] lstrlenW (lpString="Second") returned 6 [0094.692] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.692] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0094.692] lstrlenW (lpString="Third") returned 5 [0094.692] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.692] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0094.692] lstrlenW (lpString="Fourth") returned 6 [0094.692] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.693] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0094.693] lstrlenW (lpString="Last") returned 4 [0094.693] lstrlenW (lpString="1") returned 1 [0094.693] _wtol (_String="1") returned 1 [0094.693] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.693] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0094.693] lstrlenW (lpString="First") returned 5 [0094.693] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.693] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0094.693] lstrlenW (lpString="Second") returned 6 [0094.693] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.693] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0094.693] lstrlenW (lpString="Third") returned 5 [0094.693] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.693] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0094.693] lstrlenW (lpString="Fourth") returned 6 [0094.694] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.694] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0094.694] lstrlenW (lpString="Last") returned 4 [0094.694] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x16c9d8, cchData=128 | out: lpLCData="0") returned 2 [0094.694] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.694] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0094.694] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0094.694] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x16c9e0, cchData=128 | out: lpLCData="0") returned 2 [0094.694] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0094.694] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1d37f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0094.694] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0094.694] GetLocalTime (in: lpSystemTime=0x16cfac | out: lpSystemTime=0x16cfac*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x1, wDay=0x15, wHour=0xc, wMinute=0x13, wSecond=0x39, wMilliseconds=0x174)) [0094.695] lstrlenW (lpString="") returned 0 [0094.695] lstrlenW (lpString="") returned 0 [0094.695] lstrlenW (lpString="") returned 0 [0094.695] lstrlenW (lpString="") returned 0 [0094.695] lstrlenW (lpString="1") returned 1 [0094.695] _wtol (_String="1") returned 1 [0094.695] lstrlenW (lpString="") returned 0 [0094.695] lstrlenW (lpString="") returned 0 [0094.695] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0094.791] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0094.861] CoCreateInstance (in: rclsid=0xce230c*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xce20fc*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x16cf64 | out: ppv=0x16cf64*=0x4625e8) returned 0x0 [0095.033] TaskScheduler:ITaskService:Connect (This=0x4625e8, serverName=0x16ced4*(varType=0x8, wReserved1=0x8711, wReserved2=0xcf68, wReserved3=0x16, varVal1=0x0, varVal2=0x16cf4c), user=0x16cee4*(varType=0x0, wReserved1=0x75c2, wReserved2=0xd29c, wReserved3=0xd72c, varVal1=0x16ea40, varVal2=0x16de50), domain=0x16cef4*(varType=0x0, wReserved1=0x2a7b, wReserved2=0xde18, wReserved3=0x16, varVal1=0xce994e, varVal2=0x1d2f58), password=0x16cf04*(varType=0x0, wReserved1=0x7793, wReserved2=0x3c, wReserved3=0x0, varVal1=0x8711a000, varVal2=0x21)) returned 0x0 [0095.174] TaskScheduler:IUnknown:AddRef (This=0x4625e8) returned 0x2 [0095.174] TaskScheduler:ITaskService:GetFolder (in: This=0x4625e8, Path=0x0, ppFolder=0x16d008 | out: ppFolder=0x16d008*=0x4626d8) returned 0x0 [0095.177] TaskScheduler:ITaskService:NewTask (in: This=0x4625e8, flags=0x0, ppDefinition=0x16d018 | out: ppDefinition=0x16d018*=0x462728) returned 0x0 [0095.178] ITaskDefinition:get_Actions (in: This=0x462728, ppActions=0x16cf64 | out: ppActions=0x16cf64*=0x4627a0) returned 0x0 [0095.178] IActionCollection:Create (in: This=0x4627a0, Type=0, ppAction=0x16cf7c | out: ppAction=0x16cf7c*=0x4629d8) returned 0x0 [0095.178] IUnknown:Release (This=0x4629d8) returned 0x1 [0095.178] IUnknown:Release (This=0x4627a0) returned 0x1 [0095.178] ITaskDefinition:get_Triggers (in: This=0x462728, ppTriggers=0x16cb50 | out: ppTriggers=0x16cb50*=0x462858) returned 0x0 [0095.178] ITriggerCollection:Create (in: This=0x462858, Type=1, ppTrigger=0x16cb5c | out: ppTrigger=0x16cb5c*=0x462a28) returned 0x0 [0095.178] lstrlenW (lpString="1") returned 1 [0095.179] _vsnwprintf (in: _Buffer=0x16caf0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x16cae4 | out: _Buffer="PT1M") returned 4 [0095.179] ITrigger:get_Repetition (in: This=0x462a28, ppRepeat=0x16cb60 | out: ppRepeat=0x16cb60*=0x462a78) returned 0x0 [0095.179] IRepetitionPattern:put_Interval (This=0x462a78, Interval="PT1M") returned 0x0 [0095.179] IUnknown:Release (This=0x462a78) returned 0x1 [0095.179] _vsnwprintf (in: _Buffer=0x16cac0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x16caa8 | out: _Buffer="2019-01-21T12:19:00") returned 19 [0095.179] ITrigger:put_StartBoundary (This=0x462a28, StartBoundary="2019-01-21T12:19:00") returned 0x0 [0095.179] lstrlenW (lpString="") returned 0 [0095.179] lstrlenW (lpString="") returned 0 [0095.179] lstrlenW (lpString="") returned 0 [0095.179] lstrlenW (lpString="") returned 0 [0095.179] IUnknown:Release (This=0x462a28) returned 0x1 [0095.179] IUnknown:Release (This=0x462858) returned 0x1 [0095.179] ITaskDefinition:get_Settings (in: This=0x462728, ppSettings=0x16cf6c | out: ppSettings=0x16cf6c*=0x462898) returned 0x0 [0095.179] lstrlenW (lpString="") returned 0 [0095.179] IUnknown:Release (This=0x462898) returned 0x1 [0095.179] GetLocalTime (in: lpSystemTime=0x16ce5c | out: lpSystemTime=0x16ce5c*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x1, wDay=0x15, wHour=0xc, wMinute=0x13, wSecond=0x39, wMilliseconds=0x2cb)) [0095.179] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x76f70000 [0095.180] GetProcAddress (hModule=0x76f70000, lpProcName="GetUserNameW") returned 0x76f8157a [0095.180] GetUserNameW (in: lpBuffer=0x16ce70, pcbBuffer=0x16ce58 | out: lpBuffer="JPenUM", pcbBuffer=0x16ce58) returned 1 [0095.180] ITaskDefinition:get_RegistrationInfo (in: This=0x462728, ppRegistrationInfo=0x16ce6c | out: ppRegistrationInfo=0x16ce6c*=0x4627e8) returned 0x0 [0095.180] IRegistrationInfo:put_Author (This=0x4627e8, Author="JPenUM") returned 0x0 [0095.180] _vsnwprintf (in: _Buffer=0x16ce70, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x16ce30 | out: _Buffer="2019-01-21T12:19:57") returned 19 [0095.180] IRegistrationInfo:put_Date (This=0x4627e8, Date="2019-01-21T12:19:57") returned 0x0 [0095.180] IUnknown:Release (This=0x4627e8) returned 0x1 [0095.180] lstrlenW (lpString="") returned 0 [0095.180] ITaskFolder:RegisterTaskDefinition (in: This=0x4626d8, Path="RtkAudioService64", pDefinition=0x462728, flags=6, UserId=0x16cf54*(varType=0x0, wReserved1=0x0, wReserved2=0x4150, wReserved3=0x5352, varVal1=0x325245, varVal2=0x1), password=0x16cf64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x16cf78*(varType=0x0, wReserved1=0x0, wReserved2=0xcc00, wReserved3=0x16, varVal1=0x0, varVal2=0x0), ppTask=0x16d004 | out: ppTask=0x16d004*=0x462bc8) returned 0x0 [0095.365] _memicmp (_Buf1=0x1ce400, _Buf2=0xce1ed8, _Size=0x7) returned 0 [0095.365] _vsnwprintf (in: _Buffer=0x16d41c, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x16cf88 | out: _Buffer="SUCCESS: The scheduled task \"RtkAudioService64\" has successfully been created.\n") returned 79 [0095.365] _fileno (_File=0x76cf2920) returned 1 [0095.365] _errno () returned 0x4607d8 [0095.365] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.365] _errno () returned 0x4607d8 [0095.365] GetFileType (hFile=0x7) returned 0x2 [0095.365] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0095.365] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16cf4c | out: lpMode=0x16cf4c) returned 1 [0095.365] __iob_func () returned 0x76cf2900 [0095.365] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0095.365] lstrlenW (lpString="SUCCESS: The scheduled task \"RtkAudioService64\" has successfully been created.\n") returned 79 [0095.365] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x16d41c*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x16cf74, lpReserved=0x0 | out: lpBuffer=0x16d41c*, lpNumberOfCharsWritten=0x16cf74*=0x4f) returned 1 [0095.366] IUnknown:Release (This=0x462bc8) returned 0x0 [0095.366] TaskScheduler:IUnknown:Release (This=0x462728) returned 0x0 [0095.366] TaskScheduler:IUnknown:Release (This=0x4626d8) returned 0x0 [0095.366] TaskScheduler:IUnknown:Release (This=0x4625e8) returned 0x1 [0095.366] lstrlenW (lpString="") returned 0 [0095.366] lstrlenW (lpString="1") returned 1 [0095.366] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 Thread: id = 217 os_tid = 0xa34 Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7f1f6720" os_pid = "0xa20" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x30c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\" /k ping 127.0.0.1 -t 0 & del C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe & exit " cur_dir = "C:\\Windows\\system32\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2261 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2262 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2263 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2264 start_va = 0x190000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2265 start_va = 0x4a210000 end_va = 0x4a25bfff entry_point = 0x4a210000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 2266 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2267 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2268 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 2269 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 2270 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 2315 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2316 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2317 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2318 start_va = 0x380000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 2319 start_va = 0x470000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 2320 start_va = 0x6ebd0000 end_va = 0x6ebd6fff entry_point = 0x6ebd0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 2321 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2322 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2323 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2324 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2325 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2326 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2327 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2328 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 2329 start_va = 0xc0000 end_va = 0x187fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2330 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2331 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2332 start_va = 0x290000 end_va = 0x296fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 2333 start_va = 0x2a0000 end_va = 0x2a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 2334 start_va = 0x2b0000 end_va = 0x2b0fff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 2335 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2336 start_va = 0x570000 end_va = 0x670fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 2337 start_va = 0x680000 end_va = 0x127ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 2338 start_va = 0x1280000 end_va = 0x150afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001280000" filename = "" Region: id = 2346 start_va = 0x1510000 end_va = 0x17defff entry_point = 0x1510000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 216 os_tid = 0xa24 [0094.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28ff7c | out: lpSystemTimeAsFileTime=0x28ff7c*(dwLowDateTime=0x268dbb90, dwHighDateTime=0x1d4b1a5)) [0094.827] GetCurrentProcessId () returned 0xa20 [0094.827] GetCurrentThreadId () returned 0xa24 [0094.827] GetTickCount () returned 0xa703ba [0094.828] QueryPerformanceCounter (in: lpPerformanceCount=0x28ff74 | out: lpPerformanceCount=0x28ff74*=1821302500000) returned 1 [0094.828] GetModuleHandleA (lpModuleName=0x0) returned 0x4a210000 [0094.828] __set_app_type (_Type=0x1) [0094.828] __p__fmode () returned 0x76cf31f4 [0094.828] __p__commode () returned 0x76cf31fc [0094.828] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2321a6) returned 0x0 [0094.828] __getmainargs (in: _Argc=0x4a234238, _Argv=0x4a234240, _Env=0x4a23423c, _DoWildCard=0, _StartInfo=0x4a234140 | out: _Argc=0x4a234238, _Argv=0x4a234240, _Env=0x4a23423c) returned 0 [0094.829] GetCurrentThreadId () returned 0xa24 [0094.829] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa24) returned 0x38 [0094.829] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0094.829] GetProcAddress (hModule=0x777b0000, lpProcName="SetThreadUILanguage") returned 0x778024c2 [0094.829] SetThreadUILanguage (LangId=0x0) returned 0x409 [0094.829] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0094.829] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x28ff0c | out: phkResult=0x28ff0c*=0x0) returned 0x2 [0094.829] VirtualQuery (in: lpAddress=0x28ff43, lpBuffer=0x28fedc, dwLength=0x1c | out: lpBuffer=0x28fedc*(BaseAddress=0x28f000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0094.829] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x28fedc, dwLength=0x1c | out: lpBuffer=0x28fedc*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0094.829] VirtualQuery (in: lpAddress=0x191000, lpBuffer=0x28fedc, dwLength=0x1c | out: lpBuffer=0x28fedc*(BaseAddress=0x191000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0094.829] VirtualQuery (in: lpAddress=0x193000, lpBuffer=0x28fedc, dwLength=0x1c | out: lpBuffer=0x28fedc*(BaseAddress=0x193000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0094.829] VirtualQuery (in: lpAddress=0x290000, lpBuffer=0x28fedc, dwLength=0x1c | out: lpBuffer=0x28fedc*(BaseAddress=0x290000, AllocationBase=0x290000, AllocationProtect=0x2, RegionSize=0x7000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0094.829] GetConsoleOutputCP () returned 0x1b5 [0094.829] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a234260 | out: lpCPInfo=0x4a234260) returned 1 [0094.829] SetConsoleCtrlHandler (HandlerRoutine=0x4a22e72a, Add=1) returned 1 [0094.829] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.829] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0094.830] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.830] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2341ac | out: lpMode=0x4a2341ac) returned 1 [0094.830] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.830] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0094.830] _get_osfhandle (_FileHandle=0) returned 0x3 [0094.830] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2341b0 | out: lpMode=0x4a2341b0) returned 1 [0094.830] _get_osfhandle (_FileHandle=0) returned 0x3 [0094.830] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0094.830] GetEnvironmentStringsW () returned 0x4802b0* [0094.830] FreeEnvironmentStringsW (penv=0x4802b0) returned 1 [0094.830] GetEnvironmentStringsW () returned 0x4802b0* [0094.831] FreeEnvironmentStringsW (penv=0x4802b0) returned 1 [0094.831] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28ee7c | out: phkResult=0x28ee7c*=0x40) returned 0x0 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x0, lpData=0x28ee88*=0x60, lpcbData=0x28ee80*=0x1000) returned 0x2 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x4, lpData=0x28ee88*=0x1, lpcbData=0x28ee80*=0x4) returned 0x0 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x0, lpData=0x28ee88*=0x1, lpcbData=0x28ee80*=0x1000) returned 0x2 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x4, lpData=0x28ee88*=0x0, lpcbData=0x28ee80*=0x4) returned 0x0 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x4, lpData=0x28ee88*=0x40, lpcbData=0x28ee80*=0x4) returned 0x0 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x4, lpData=0x28ee88*=0x40, lpcbData=0x28ee80*=0x4) returned 0x0 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x0, lpData=0x28ee88*=0x40, lpcbData=0x28ee80*=0x1000) returned 0x2 [0094.831] RegCloseKey (hKey=0x40) returned 0x0 [0094.831] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28ee7c | out: phkResult=0x28ee7c*=0x40) returned 0x0 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x0, lpData=0x28ee88*=0x40, lpcbData=0x28ee80*=0x1000) returned 0x2 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x4, lpData=0x28ee88*=0x1, lpcbData=0x28ee80*=0x4) returned 0x0 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x0, lpData=0x28ee88*=0x1, lpcbData=0x28ee80*=0x1000) returned 0x2 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x4, lpData=0x28ee88*=0x0, lpcbData=0x28ee80*=0x4) returned 0x0 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x4, lpData=0x28ee88*=0x9, lpcbData=0x28ee80*=0x4) returned 0x0 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x4, lpData=0x28ee88*=0x9, lpcbData=0x28ee80*=0x4) returned 0x0 [0094.831] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28ee84, lpData=0x28ee88, lpcbData=0x28ee80*=0x1000 | out: lpType=0x28ee84*=0x0, lpData=0x28ee88*=0x9, lpcbData=0x28ee80*=0x1000) returned 0x2 [0094.831] RegCloseKey (hKey=0x40) returned 0x0 [0094.831] time (in: timer=0x0 | out: timer=0x0) returned 0x5c45f12d [0094.831] srand (_Seed=0x5c45f12d) [0094.832] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" /k ping 127.0.0.1 -t 0 & del C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe & exit " [0094.832] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" /k ping 127.0.0.1 -t 0 & del C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe & exit " [0094.832] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a235260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.832] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x481c38, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0094.832] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a240640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0094.832] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a240640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0094.832] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a240640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0094.832] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0094.832] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0094.832] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0094.832] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0094.832] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0094.832] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0094.832] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0094.832] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0094.832] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0094.833] GetEnvironmentStringsW () returned 0x4826e0* [0094.833] FreeEnvironmentStringsW (penv=0x4826e0) returned 1 [0094.833] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a240640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.833] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a240640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0094.833] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0094.833] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0094.833] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0094.833] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0094.833] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0094.833] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0094.833] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0094.833] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0094.833] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x28fc48 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.833] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x28fc48, lpFilePart=0x28fc44 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x28fc44*="system32") returned 0x13 [0094.833] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0094.833] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x28f9c4 | out: lpFindFileData=0x28f9c4) returned 0x480b48 [0094.833] FindClose (in: hFindFile=0x480b48 | out: hFindFile=0x480b48) returned 1 [0094.833] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x28f9c4 | out: lpFindFileData=0x28f9c4) returned 0x480b48 [0094.834] FindClose (in: hFindFile=0x480b48 | out: hFindFile=0x480b48) returned 1 [0094.834] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0094.834] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0094.834] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0094.834] GetEnvironmentStringsW () returned 0x4802b0* [0094.834] FreeEnvironmentStringsW (penv=0x4802b0) returned 1 [0094.834] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a235260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.835] GetConsoleOutputCP () returned 0x1b5 [0094.835] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a234260 | out: lpCPInfo=0x4a234260) returned 1 [0094.835] GetUserDefaultLCID () returned 0x409 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a234950, cchData=8 | out: lpLCData=":") returned 2 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x28fd88, cchData=128 | out: lpLCData="0") returned 2 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x28fd88, cchData=128 | out: lpLCData="0") returned 2 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x28fd88, cchData=128 | out: lpLCData="1") returned 2 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a234940, cchData=8 | out: lpLCData="/") returned 2 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a234d80, cchData=32 | out: lpLCData="Mon") returned 4 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a234d40, cchData=32 | out: lpLCData="Tue") returned 4 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a234d00, cchData=32 | out: lpLCData="Wed") returned 4 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a234cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a234c80, cchData=32 | out: lpLCData="Fri") returned 4 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a234c40, cchData=32 | out: lpLCData="Sat") returned 4 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a234c00, cchData=32 | out: lpLCData="Sun") returned 4 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a234930, cchData=8 | out: lpLCData=".") returned 2 [0094.836] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a234920, cchData=8 | out: lpLCData=",") returned 2 [0094.836] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0094.837] GetConsoleTitleW (in: lpConsoleTitle=0x470908, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.838] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.838] GetFileType (hFile=0x7) returned 0x2 [0094.838] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.838] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28fe84 | out: lpMode=0x28fe84) returned 1 [0094.838] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.838] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x28fea0 | out: lpConsoleScreenBufferInfo=0x28fea0) returned 1 [0094.838] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.838] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x28fe6c | out: lpConsoleScreenBufferInfo=0x28fe6c) returned 1 [0094.838] FillConsoleOutputAttribute (in: hConsoleOutput=0x7, wAttribute=0x7, nLength=0x5dc0, dwWriteCoord=0x0, lpNumberOfAttrsWritten=0x28fe84 | out: lpNumberOfAttrsWritten=0x28fe84) returned 1 [0094.838] SetConsoleTextAttribute (hConsoleOutput=0x7, wAttributes=0x7) returned 1 [0094.839] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0094.839] GetProcAddress (hModule=0x777b0000, lpProcName="CopyFileExW") returned 0x777eac6c [0094.839] GetProcAddress (hModule=0x777b0000, lpProcName="IsDebuggerPresent") returned 0x777f3ea8 [0094.839] GetProcAddress (hModule=0x777b0000, lpProcName="SetConsoleInputExeNameW") returned 0x77802732 [0094.839] _wcsicmp (_String1="ping", _String2=")") returned 71 [0094.839] _wcsicmp (_String1="FOR", _String2="ping") returned -10 [0094.840] _wcsicmp (_String1="FOR/?", _String2="ping") returned -10 [0094.840] _wcsicmp (_String1="IF", _String2="ping") returned -7 [0094.840] _wcsicmp (_String1="IF/?", _String2="ping") returned -7 [0094.840] _wcsicmp (_String1="REM", _String2="ping") returned 2 [0094.840] _wcsicmp (_String1="REM/?", _String2="ping") returned 2 [0094.841] _wcsicmp (_String1="del", _String2=")") returned 59 [0094.841] _wcsicmp (_String1="FOR", _String2="del") returned 2 [0094.841] _wcsicmp (_String1="FOR/?", _String2="del") returned 2 [0094.841] _wcsicmp (_String1="IF", _String2="del") returned 5 [0094.841] _wcsicmp (_String1="IF/?", _String2="del") returned 5 [0094.841] _wcsicmp (_String1="REM", _String2="del") returned 14 [0094.841] _wcsicmp (_String1="REM/?", _String2="del") returned 14 [0094.844] _wcsicmp (_String1="exit", _String2=")") returned 60 [0094.844] _wcsicmp (_String1="FOR", _String2="exit") returned 1 [0094.844] _wcsicmp (_String1="FOR/?", _String2="exit") returned 1 [0094.844] _wcsicmp (_String1="IF", _String2="exit") returned 4 [0094.844] _wcsicmp (_String1="IF/?", _String2="exit") returned 4 [0094.844] _wcsicmp (_String1="REM", _String2="exit") returned 13 [0094.844] _wcsicmp (_String1="REM/?", _String2="exit") returned 13 [0094.845] GetConsoleTitleW (in: lpConsoleTitle=0x28fa1c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.845] _wcsicmp (_String1="ping", _String2="DIR") returned 12 [0094.845] _wcsicmp (_String1="ping", _String2="ERASE") returned 11 [0094.845] _wcsicmp (_String1="ping", _String2="DEL") returned 12 [0094.845] _wcsicmp (_String1="ping", _String2="TYPE") returned -4 [0094.845] _wcsicmp (_String1="ping", _String2="COPY") returned 13 [0094.845] _wcsicmp (_String1="ping", _String2="CD") returned 13 [0094.845] _wcsicmp (_String1="ping", _String2="CHDIR") returned 13 [0094.845] _wcsicmp (_String1="ping", _String2="RENAME") returned -2 [0094.845] _wcsicmp (_String1="ping", _String2="REN") returned -2 [0094.845] _wcsicmp (_String1="ping", _String2="ECHO") returned 11 [0094.845] _wcsicmp (_String1="ping", _String2="SET") returned -3 [0094.845] _wcsicmp (_String1="ping", _String2="PAUSE") returned 8 [0094.845] _wcsicmp (_String1="ping", _String2="DATE") returned 12 [0094.845] _wcsicmp (_String1="ping", _String2="TIME") returned -4 [0094.845] _wcsicmp (_String1="ping", _String2="PROMPT") returned -9 [0094.845] _wcsicmp (_String1="ping", _String2="MD") returned 3 [0094.845] _wcsicmp (_String1="ping", _String2="MKDIR") returned 3 [0094.846] _wcsicmp (_String1="ping", _String2="RD") returned -2 [0094.846] _wcsicmp (_String1="ping", _String2="RMDIR") returned -2 [0094.846] _wcsicmp (_String1="ping", _String2="PATH") returned 8 [0094.846] _wcsicmp (_String1="ping", _String2="GOTO") returned 9 [0094.846] _wcsicmp (_String1="ping", _String2="SHIFT") returned -3 [0094.846] _wcsicmp (_String1="ping", _String2="CLS") returned 13 [0094.846] _wcsicmp (_String1="ping", _String2="CALL") returned 13 [0094.846] _wcsicmp (_String1="ping", _String2="VERIFY") returned -6 [0094.846] _wcsicmp (_String1="ping", _String2="VER") returned -6 [0094.846] _wcsicmp (_String1="ping", _String2="VOL") returned -6 [0094.846] _wcsicmp (_String1="ping", _String2="EXIT") returned 11 [0094.846] _wcsicmp (_String1="ping", _String2="SETLOCAL") returned -3 [0094.846] _wcsicmp (_String1="ping", _String2="ENDLOCAL") returned 11 [0094.846] _wcsicmp (_String1="ping", _String2="TITLE") returned -4 [0094.846] _wcsicmp (_String1="ping", _String2="START") returned -3 [0094.846] _wcsicmp (_String1="ping", _String2="DPATH") returned 12 [0094.846] _wcsicmp (_String1="ping", _String2="KEYS") returned 5 [0094.846] _wcsicmp (_String1="ping", _String2="MOVE") returned 3 [0094.846] _wcsicmp (_String1="ping", _String2="PUSHD") returned -12 [0094.846] _wcsicmp (_String1="ping", _String2="POPD") returned -6 [0094.846] _wcsicmp (_String1="ping", _String2="ASSOC") returned 15 [0094.846] _wcsicmp (_String1="ping", _String2="FTYPE") returned 10 [0094.846] _wcsicmp (_String1="ping", _String2="BREAK") returned 14 [0094.846] _wcsicmp (_String1="ping", _String2="COLOR") returned 13 [0094.846] _wcsicmp (_String1="ping", _String2="MKLINK") returned 3 [0094.846] _wcsicmp (_String1="ping", _String2="DIR") returned 12 [0094.846] _wcsicmp (_String1="ping", _String2="ERASE") returned 11 [0094.846] _wcsicmp (_String1="ping", _String2="DEL") returned 12 [0094.846] _wcsicmp (_String1="ping", _String2="TYPE") returned -4 [0094.846] _wcsicmp (_String1="ping", _String2="COPY") returned 13 [0094.846] _wcsicmp (_String1="ping", _String2="CD") returned 13 [0094.846] _wcsicmp (_String1="ping", _String2="CHDIR") returned 13 [0094.846] _wcsicmp (_String1="ping", _String2="RENAME") returned -2 [0094.846] _wcsicmp (_String1="ping", _String2="REN") returned -2 [0094.846] _wcsicmp (_String1="ping", _String2="ECHO") returned 11 [0094.846] _wcsicmp (_String1="ping", _String2="SET") returned -3 [0094.846] _wcsicmp (_String1="ping", _String2="PAUSE") returned 8 [0094.846] _wcsicmp (_String1="ping", _String2="DATE") returned 12 [0094.846] _wcsicmp (_String1="ping", _String2="TIME") returned -4 [0094.846] _wcsicmp (_String1="ping", _String2="PROMPT") returned -9 [0094.847] _wcsicmp (_String1="ping", _String2="MD") returned 3 [0094.847] _wcsicmp (_String1="ping", _String2="MKDIR") returned 3 [0094.847] _wcsicmp (_String1="ping", _String2="RD") returned -2 [0094.847] _wcsicmp (_String1="ping", _String2="RMDIR") returned -2 [0094.847] _wcsicmp (_String1="ping", _String2="PATH") returned 8 [0094.847] _wcsicmp (_String1="ping", _String2="GOTO") returned 9 [0094.847] _wcsicmp (_String1="ping", _String2="SHIFT") returned -3 [0094.847] _wcsicmp (_String1="ping", _String2="CLS") returned 13 [0094.847] _wcsicmp (_String1="ping", _String2="CALL") returned 13 [0094.847] _wcsicmp (_String1="ping", _String2="VERIFY") returned -6 [0094.847] _wcsicmp (_String1="ping", _String2="VER") returned -6 [0094.847] _wcsicmp (_String1="ping", _String2="VOL") returned -6 [0094.847] _wcsicmp (_String1="ping", _String2="EXIT") returned 11 [0094.847] _wcsicmp (_String1="ping", _String2="SETLOCAL") returned -3 [0094.847] _wcsicmp (_String1="ping", _String2="ENDLOCAL") returned 11 [0094.847] _wcsicmp (_String1="ping", _String2="TITLE") returned -4 [0094.847] _wcsicmp (_String1="ping", _String2="START") returned -3 [0094.847] _wcsicmp (_String1="ping", _String2="DPATH") returned 12 [0094.847] _wcsicmp (_String1="ping", _String2="KEYS") returned 5 [0094.847] _wcsicmp (_String1="ping", _String2="MOVE") returned 3 [0094.847] _wcsicmp (_String1="ping", _String2="PUSHD") returned -12 [0094.847] _wcsicmp (_String1="ping", _String2="POPD") returned -6 [0094.847] _wcsicmp (_String1="ping", _String2="ASSOC") returned 15 [0094.847] _wcsicmp (_String1="ping", _String2="FTYPE") returned 10 [0094.847] _wcsicmp (_String1="ping", _String2="BREAK") returned 14 [0094.847] _wcsicmp (_String1="ping", _String2="COLOR") returned 13 [0094.847] _wcsicmp (_String1="ping", _String2="MKLINK") returned 3 [0094.847] _wcsicmp (_String1="ping", _String2="FOR") returned 10 [0094.847] _wcsicmp (_String1="ping", _String2="IF") returned 7 [0094.847] _wcsicmp (_String1="ping", _String2="REM") returned -2 [0094.847] _wcsnicmp (_String1="ping", _String2="cmd ", _MaxCount=0x4) returned 13 [0094.848] SetErrorMode (uMode=0x0) returned 0x0 [0094.848] SetErrorMode (uMode=0x1) returned 0x0 [0094.848] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x481e90, lpFilePart=0x28f53c | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x28f53c*="system32") returned 0x13 [0094.848] SetErrorMode (uMode=0x0) returned 0x1 [0094.848] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a240640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0094.848] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0094.852] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a240640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0094.852] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\ping.*", fInfoLevelId=0x1, lpFindFileData=0x28f2b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f2b8) returned 0x482160 [0094.853] FindClose (in: hFindFile=0x482160 | out: hFindFile=0x482160) returned 1 [0094.853] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\PING.COM", fInfoLevelId=0x1, lpFindFileData=0x28f2b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f2b8) returned 0xffffffff [0094.853] GetLastError () returned 0x2 [0094.853] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\PING.EXE", fInfoLevelId=0x1, lpFindFileData=0x28f2b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f2b8) returned 0x482160 [0094.853] FindClose (in: hFindFile=0x482160 | out: hFindFile=0x482160) returned 1 [0094.853] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0094.853] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0094.853] GetConsoleTitleW (in: lpConsoleTitle=0x28f7b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0095.011] GetConsoleTitleW (in: lpConsoleTitle=0x482168, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0095.011] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - ping 127.0.0.1 -t 0 ") returned 1 [0095.012] InitializeProcThreadAttributeList (in: lpAttributeList=0x28f638, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28f700 | out: lpAttributeList=0x28f638, lpSize=0x28f700) returned 1 [0095.012] UpdateProcThreadAttribute (in: lpAttributeList=0x28f638, dwFlags=0x0, Attribute=0x60001, lpValue=0x28f6f8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28f638, lpPreviousValue=0x0) returned 1 [0095.012] GetStartupInfoW (in: lpStartupInfo=0x28f5f4 | out: lpStartupInfo=0x28f5f4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x10000, hStdOutput=0x482158, hStdError=0x28f724)) [0095.012] lstrcmpW (lpString1="\\PING.EXE", lpString2="\\XCOPY.EXE") returned -1 [0095.016] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\PING.EXE", lpCommandLine="ping 127.0.0.1 -t 0 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x28f694*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="ping 127.0.0.1 -t 0 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28f6e0 | out: lpCommandLine="ping 127.0.0.1 -t 0 ", lpProcessInformation=0x28f6e0*(hProcess=0x50, hThread=0x4c, dwProcessId=0xa3c, dwThreadId=0xa40)) returned 1 [0095.027] CloseHandle (hObject=0x4c) returned 1 [0095.027] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0095.027] GetEnvironmentStringsW () returned 0x4802b0* [0095.027] FreeEnvironmentStringsW (penv=0x4802b0) returned 1 [0095.027] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0095.243] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x28f5d4 | out: lpExitCode=0x28f5d4*=0x1) returned 1 [0095.243] CloseHandle (hObject=0x50) returned 1 [0095.243] _vsnwprintf (in: _Buffer=0x28f71c, _BufferCount=0x13, _Format="%08X", _ArgList=0x28f5e0 | out: _Buffer="00000001") returned 8 [0095.243] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0095.243] GetEnvironmentStringsW () returned 0x4823a0* [0095.243] FreeEnvironmentStringsW (penv=0x4823a0) returned 1 [0095.244] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0095.244] GetEnvironmentStringsW () returned 0x4823a0* [0095.244] FreeEnvironmentStringsW (penv=0x4823a0) returned 1 [0095.244] DeleteProcThreadAttributeList (in: lpAttributeList=0x28f638 | out: lpAttributeList=0x28f638) [0095.244] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0095.244] GetConsoleTitleW (in: lpConsoleTitle=0x28f9b8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0095.244] GetConsoleTitleW (in: lpConsoleTitle=0x480d50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0095.245] SetConsoleTitleW (lpConsoleTitle="del C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe ") returned 1 [0095.246] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x28f770 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.246] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x28e800 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.246] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x28ea30, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x28ea34, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x28ea30*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0095.246] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0095.246] _wcsicmp (_String1="MsMpEng.exe", _String2=".") returned 63 [0095.246] _wcsicmp (_String1="MsMpEng.exe", _String2="..") returned 63 [0095.246] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe")) returned 0x20 [0095.247] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4810b8 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.247] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files")) returned 0x2010 [0095.247] _wcsicmp (_String1="MsMpEng.exe", _String2=".") returned 63 [0095.247] _wcsicmp (_String1="MsMpEng.exe", _String2="..") returned 63 [0095.247] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe")) returned 0x20 [0095.247] FindFirstFileExW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe", fInfoLevelId=0x0, lpFindFileData=0x48358c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x48358c) returned 0x4826b8 [0095.247] DeleteFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\MW-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\MsMpEng.exe" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\mw-3cee3894-a0d4-4f50-a87c-21985e988377\\files\\msmpeng.exe")) returned 1 [0095.258] FindNextFileW (in: hFindFile=0x4826b8, lpFindFileData=0x48358c | out: lpFindFileData=0x48358c) returned 0 [0095.258] GetLastError () returned 0x12 [0095.258] FindClose (in: hFindFile=0x4826b8 | out: hFindFile=0x4826b8) returned 1 [0095.259] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0095.259] GetConsoleTitleW (in: lpConsoleTitle=0x28f9b8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0095.259] GetConsoleTitleW (in: lpConsoleTitle=0x480d50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0095.259] SetConsoleTitleW (lpConsoleTitle="exit ") returned 1 [0095.260] _wcsnicmp (_String1="", _String2="/B", _MaxCount=0x2) returned -47 [0095.260] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0095.260] exit (_Code=0) Process: id = "16" image_name = "ping.exe" filename = "c:\\windows\\system32\\ping.exe" page_root = "0x7f1f6760" os_pid = "0xa3c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xa20" cmd_line = "ping 127.0.0.1 -t 0 " cur_dir = "C:\\Windows\\system32\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2350 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2351 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2352 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2353 start_va = 0x180000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2354 start_va = 0x2a0000 end_va = 0x2a7fff entry_point = 0x2a0000 region_type = mapped_file name = "ping.exe" filename = "\\Windows\\System32\\PING.EXE" (normalized: "c:\\windows\\system32\\ping.exe") Region: id = 2355 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2356 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2357 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 2358 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 2359 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 2360 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2361 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2362 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2363 start_va = 0x170000 end_va = 0x17ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2364 start_va = 0x350000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2365 start_va = 0x74420000 end_va = 0x74426fff entry_point = 0x74420000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2366 start_va = 0x74430000 end_va = 0x7444bfff entry_point = 0x74430000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2367 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2368 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2369 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2370 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2371 start_va = 0x76b60000 end_va = 0x76b94fff entry_point = 0x76b60000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2372 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2373 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2374 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2375 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2376 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2377 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2378 start_va = 0x77b00000 end_va = 0x77b05fff entry_point = 0x77b00000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2379 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 2380 start_va = 0x1c0000 end_va = 0x287fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 2381 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2382 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2383 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2384 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2385 start_va = 0xe0000 end_va = 0xe2fff entry_point = 0xe0000 region_type = mapped_file name = "ping.exe.mui" filename = "\\Windows\\System32\\en-US\\ping.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\ping.exe.mui") Region: id = 2386 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2387 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2388 start_va = 0x450000 end_va = 0x550fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 2389 start_va = 0x560000 end_va = 0x115ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 2391 start_va = 0x1160000 end_va = 0x142efff entry_point = 0x1160000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 218 os_tid = 0xa40 [0095.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1bfaf4 | out: lpSystemTimeAsFileTime=0x1bfaf4*(dwLowDateTime=0x26acad70, dwHighDateTime=0x1d4b1a5)) [0095.171] GetCurrentProcessId () returned 0xa3c [0095.171] GetCurrentThreadId () returned 0xa40 [0095.171] GetTickCount () returned 0xa70485 [0095.171] QueryPerformanceCounter (in: lpPerformanceCount=0x1bfaec | out: lpPerformanceCount=0x1bfaec*=1821336900000) returned 1 [0095.172] GetModuleHandleA (lpModuleName=0x0) returned 0x2a0000 [0095.172] __set_app_type (_Type=0x1) [0095.172] __p__fmode () returned 0x76cf31f4 [0095.172] __p__commode () returned 0x76cf31fc [0095.172] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x2a2ae1) returned 0x0 [0095.172] __getmainargs (in: _Argc=0x2a50d4, _Argv=0x2a50dc, _Env=0x2a50d8, _DoWildCard=0, _StartInfo=0x2a50e8 | out: _Argc=0x2a50d4, _Argv=0x2a50dc, _Env=0x2a50d8) returned 0 [0095.172] SetThreadUILanguage (LangId=0x0) returned 0x409 [0095.193] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0095.193] WSAStartup (in: wVersionRequired=0x2, lpWSAData=0x2a5440 | out: lpWSAData=0x2a5440) returned 0 [0095.199] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x1, phkResult=0x1bf584 | out: phkResult=0x1bf584*=0x58) returned 0x0 [0095.199] RegQueryValueExA (in: hKey=0x58, lpValueName="DefaultTTL", lpReserved=0x0, lpType=0x1bf578, lpData=0x1bf580, lpcbData=0x1bf57c*=0x4 | out: lpType=0x1bf578*=0x0, lpData=0x1bf580*=0x0, lpcbData=0x1bf57c*=0x4) returned 0x2 [0095.199] RegCloseKey (hKey=0x58) returned 0x0 [0095.199] getaddrinfo (in: pNodeName="127.0.0.1", pServiceName=0x0, pHints=0x1bf54c*(ai_flags=4, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1bf574 | out: ppResult=0x1bf574*=0x362f28*(ai_flags=4, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x35e258*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), ai_next=0x0)) returned 0 [0095.199] FreeAddrInfoW (pAddrInfo=0x362f28*(ai_flags=4, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x35e258*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), ai_next=0x0)) [0095.199] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x271c, dwLanguageId=0x0, lpBuffer=0x1bf578, nSize=0x0, Arguments=0x1bf574 | out: lpBuffer="\xf0\x98\x36") returned 0x12 [0095.200] CharToOemBuffA (in: lpszSrc="Bad parameter 0.\r\n", lpszDst=0x3698f0, cchDstLength=0x12 | out: lpszDst="Bad parameter 0.\r\n") returned 1 [0095.200] _setmode (_FileHandle=1, _Mode=32768) returned 16384 [0095.200] _write (in: _FileHandle=1, _Buf=0x3698f0*, _MaxCharCount=0x12 | out: _Buf=0x3698f0*) returned 18 [0095.200] _setmode (_FileHandle=1, _Mode=16384) returned 32768 [0095.200] LocalFree (hMem=0x3698f0) returned 0x0 [0095.200] WSACleanup () returned 0 [0095.234] exit (_Code=1) Process: id = "17" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x7f1f67a0" os_pid = "0x6e4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x354" cmd_line = "taskeng.exe {AB092593-1121-4C71-A26E-3236454BE9E3} S-1-5-21-1276836803-1479805768-3330128443-1000:ARRARNMKU\\JPenUM:Interactive:LUA[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2452 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2453 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2454 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2455 start_va = 0xb0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 2456 start_va = 0xc30000 end_va = 0xc5ffff entry_point = 0xc30000 region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 2457 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2458 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2459 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 2460 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 2461 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 2462 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2463 start_va = 0x140000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2464 start_va = 0x240000 end_va = 0x2a6fff entry_point = 0x240000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2465 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2466 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2467 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2468 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2469 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2470 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2471 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2472 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 2473 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2474 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2475 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2476 start_va = 0x70000 end_va = 0x7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2477 start_va = 0x2b0000 end_va = 0x377fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 2478 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2479 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2480 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2481 start_va = 0x50000 end_va = 0x51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2482 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2483 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2484 start_va = 0x380000 end_va = 0x480fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 2485 start_va = 0x490000 end_va = 0x882fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2486 start_va = 0x900000 end_va = 0x93ffff entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2487 start_va = 0xc60000 end_va = 0x185ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 2488 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2490 start_va = 0x9b0000 end_va = 0x9effff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 2491 start_va = 0x75500000 end_va = 0x75515fff entry_point = 0x75500000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2492 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2493 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2494 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 2495 start_va = 0x752a0000 end_va = 0x752dafff entry_point = 0x752a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2496 start_va = 0xac0000 end_va = 0xafffff entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 2497 start_va = 0x75960000 end_va = 0x7597afff entry_point = 0x75960000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2498 start_va = 0x771d0000 end_va = 0x77226fff entry_point = 0x771d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2499 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 2500 start_va = 0x9f0000 end_va = 0xa6ffff entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 2501 start_va = 0xb40000 end_va = 0xb7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 2502 start_va = 0x1860000 end_va = 0x1b2efff entry_point = 0x1860000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2503 start_va = 0x75a20000 end_va = 0x75a2dfff entry_point = 0x75a20000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2504 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 2505 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2506 start_va = 0xb90000 end_va = 0xbcffff entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 2507 start_va = 0xbd0000 end_va = 0xc0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 2508 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2509 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 2510 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 2511 start_va = 0x72000000 end_va = 0x72007fff entry_point = 0x72000000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 2515 start_va = 0x1c00000 end_va = 0x1c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 2516 start_va = 0x74060000 end_va = 0x7409ffff entry_point = 0x74060000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2517 start_va = 0x740a0000 end_va = 0x740cefff entry_point = 0x740a0000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2518 start_va = 0xa80000 end_va = 0xabffff entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 2519 start_va = 0x1c40000 end_va = 0x1d1efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c40000" filename = "" Region: id = 2520 start_va = 0x73d20000 end_va = 0x73d32fff entry_point = 0x73d20000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2521 start_va = 0x7ffd8000 end_va = 0x7ffd8fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Thread: id = 221 os_tid = 0x31c Thread: id = 222 os_tid = 0x234 Thread: id = 223 os_tid = 0x5c8 Thread: id = 224 os_tid = 0x390 Thread: id = 225 os_tid = 0x548 Thread: id = 226 os_tid = 0x5bc Thread: id = 227 os_tid = 0x160 Process: id = "18" image_name = "rtlupd64.exe" filename = "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe" page_root = "0x7f1f67c0" os_pid = "0x15c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x6e4" cmd_line = "C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2651 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2652 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2653 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2654 start_va = 0x3f0000 end_va = 0x6bdfff entry_point = 0x3f0000 region_type = mapped_file name = "rtlupd64.exe" filename = "\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe") Region: id = 2655 start_va = 0x7d0000 end_va = 0xbcffff entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 2656 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2657 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2658 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 2659 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 2660 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 2661 start_va = 0xc50000 end_va = 0x104ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 2662 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2663 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2664 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2665 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2666 start_va = 0x6ec40000 end_va = 0x6ec46fff entry_point = 0x6ec40000 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 2667 start_va = 0x70e70000 end_va = 0x70ea1fff entry_point = 0x70e70000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 2668 start_va = 0x724b0000 end_va = 0x724c1fff entry_point = 0x724b0000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 2669 start_va = 0x74060000 end_va = 0x7409ffff entry_point = 0x74060000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2670 start_va = 0x74420000 end_va = 0x74426fff entry_point = 0x74420000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2671 start_va = 0x74430000 end_va = 0x7444bfff entry_point = 0x74430000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2672 start_va = 0x74a10000 end_va = 0x74badfff entry_point = 0x74a10000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 2673 start_va = 0x74f80000 end_va = 0x74f88fff entry_point = 0x74f80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2674 start_va = 0x750e0000 end_va = 0x750f6fff entry_point = 0x750e0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2675 start_va = 0x75a30000 end_va = 0x75a3afff entry_point = 0x75a30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2676 start_va = 0x75aa0000 end_va = 0x75aabfff entry_point = 0x75aa0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2677 start_va = 0x75ab0000 end_va = 0x75bccfff entry_point = 0x75ab0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2678 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2679 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2680 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2681 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2682 start_va = 0x75f10000 end_va = 0x76b59fff entry_point = 0x75f10000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2683 start_va = 0x76b60000 end_va = 0x76b94fff entry_point = 0x76b60000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2684 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2685 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2686 start_va = 0x76d60000 end_va = 0x76e95fff entry_point = 0x76d60000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2687 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2688 start_va = 0x77030000 end_va = 0x77124fff entry_point = 0x77030000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2689 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2690 start_va = 0x771d0000 end_va = 0x77226fff entry_point = 0x771d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2691 start_va = 0x77230000 end_va = 0x772aafff entry_point = 0x77230000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 2692 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2693 start_va = 0x775b0000 end_va = 0x777aafff entry_point = 0x775b0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2694 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2695 start_va = 0x77a30000 end_va = 0x77a34fff entry_point = 0x77a30000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 2696 start_va = 0x77b00000 end_va = 0x77b05fff entry_point = 0x77b00000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2697 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 2817 start_va = 0x110000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2818 start_va = 0x120000 end_va = 0x1e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2819 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2820 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2821 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2822 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2823 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2824 start_va = 0x1f0000 end_va = 0x2f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2825 start_va = 0x320000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2826 start_va = 0x1050000 end_va = 0x1c4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001050000" filename = "" Region: id = 2827 start_va = 0x360000 end_va = 0x3bbfff entry_point = 0x360000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2828 start_va = 0x360000 end_va = 0x3bbfff entry_point = 0x360000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2829 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2830 start_va = 0x6c0000 end_va = 0x79efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 2831 start_va = 0x360000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2832 start_va = 0x1c50000 end_va = 0x1cf8fff entry_point = 0x0 region_type = private name = "private_0x0000000001c50000" filename = "" Region: id = 2833 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2834 start_va = 0x73d20000 end_va = 0x73d32fff entry_point = 0x73d20000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2835 start_va = 0x1c50000 end_va = 0x1f1efff entry_point = 0x1c50000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2836 start_va = 0xbd0000 end_va = 0xc2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 2837 start_va = 0x75960000 end_va = 0x7597afff entry_point = 0x75960000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2838 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2839 start_va = 0x1f20000 end_va = 0x201ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 2840 start_va = 0x2020000 end_va = 0x20c0fff entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 2841 start_va = 0x20d0000 end_va = 0x2170fff entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 2842 start_va = 0x2390000 end_va = 0x24d1fff entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 2843 start_va = 0x75500000 end_va = 0x75515fff entry_point = 0x75500000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2844 start_va = 0x2180000 end_va = 0x21bbfff entry_point = 0x2180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2845 start_va = 0x2180000 end_va = 0x21bbfff entry_point = 0x2180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2846 start_va = 0x2180000 end_va = 0x21bbfff entry_point = 0x2180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2847 start_va = 0x2180000 end_va = 0x21bbfff entry_point = 0x2180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2848 start_va = 0x2180000 end_va = 0x21bbfff entry_point = 0x2180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2849 start_va = 0x752a0000 end_va = 0x752dafff entry_point = 0x752a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2861 start_va = 0x2180000 end_va = 0x237ffff entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 2874 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2892 start_va = 0x2020000 end_va = 0x20c0fff entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 2893 start_va = 0x20d0000 end_va = 0x2125fff entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 3011 start_va = 0x2470000 end_va = 0x286ffff entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 3012 start_va = 0x748d0000 end_va = 0x749c4fff entry_point = 0x748d0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3013 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 3014 start_va = 0x100000 end_va = 0x101fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3015 start_va = 0x300000 end_va = 0x300fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000300000" filename = "" Region: id = 3016 start_va = 0x70f00000 end_va = 0x70f4bfff entry_point = 0x70f00000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3017 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3018 start_va = 0x310000 end_va = 0x310fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 3019 start_va = 0x6da80000 end_va = 0x6dabbfff entry_point = 0x6da80000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 3020 start_va = 0x6dac0000 end_va = 0x6e53ffff entry_point = 0x6dac0000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 3021 start_va = 0x3e0000 end_va = 0x3e0fff entry_point = 0x3e0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 3022 start_va = 0x7a0000 end_va = 0x7a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 3023 start_va = 0x7b0000 end_va = 0x7b0fff entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 3024 start_va = 0x2a20000 end_va = 0x2e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a20000" filename = "" Region: id = 3025 start_va = 0x748a0000 end_va = 0x748c0fff entry_point = 0x748a0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3026 start_va = 0x77890000 end_va = 0x778d4fff entry_point = 0x77890000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3027 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 3028 start_va = 0x7c0000 end_va = 0x7c3fff entry_point = 0x7c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3029 start_va = 0xbd0000 end_va = 0xbeffff entry_point = 0xbd0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000010.db" filename = "\\Users\\JPenUM\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000010.db" (normalized: "c:\\users\\jpenum\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000010.db") Region: id = 3030 start_va = 0xbf0000 end_va = 0xc2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 3031 start_va = 0xc30000 end_va = 0xc30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c30000" filename = "" Region: id = 3032 start_va = 0xc40000 end_va = 0xc43fff entry_point = 0xc40000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3033 start_va = 0x2020000 end_va = 0x204ffff entry_point = 0x2020000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db") Region: id = 3034 start_va = 0x2050000 end_va = 0x20b5fff entry_point = 0x2050000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 3035 start_va = 0x20c0000 end_va = 0x20c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020c0000" filename = "" Region: id = 3036 start_va = 0x20d0000 end_va = 0x20d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020d0000" filename = "" Region: id = 3037 start_va = 0x2e20000 end_va = 0x3212fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002e20000" filename = "" Region: id = 3038 start_va = 0x75c00000 end_va = 0x75c11fff entry_point = 0x75c00000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3039 start_va = 0x75c70000 end_va = 0x75c96fff entry_point = 0x75c70000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3040 start_va = 0x77410000 end_va = 0x775acfff entry_point = 0x77410000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3080 start_va = 0x20e0000 end_va = 0x20e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020e0000" filename = "" Region: id = 3081 start_va = 0x3320000 end_va = 0x371ffff entry_point = 0x0 region_type = private name = "private_0x0000000003320000" filename = "" Region: id = 3082 start_va = 0x3770000 end_va = 0x3b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000003770000" filename = "" Region: id = 3083 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 3084 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Thread: id = 243 os_tid = 0x94c [0107.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbcfe88 | out: lpSystemTimeAsFileTime=0xbcfe88*(dwLowDateTime=0x2cd8e0b0, dwHighDateTime=0x1d4b1a5)) [0107.041] GetCurrentThreadId () returned 0x94c [0107.041] GetCurrentProcessId () returned 0x15c [0107.041] QueryPerformanceCounter (in: lpPerformanceCount=0xbcfe80 | out: lpPerformanceCount=0xbcfe80*=1822523900000) returned 1 [0107.042] GetStartupInfoW (in: lpStartupInfo=0xbcfe18 | out: lpStartupInfo=0xbcfe18*(cb=0x44, lpReserved="", lpDesktop="winsta0\\default", lpTitle="taskeng.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x81, wShowWindow=0x4, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x77926164, hStdError=0x77966ed5)) [0107.044] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x777b0000 [0107.044] GetProcAddress (hModule=0x777b0000, lpProcName="FlsAlloc") returned 0x7780418d [0107.044] GetProcAddress (hModule=0x777b0000, lpProcName="FlsFree") returned 0x77801f61 [0107.044] GetProcAddress (hModule=0x777b0000, lpProcName="FlsGetValue") returned 0x77801e16 [0107.044] GetProcAddress (hModule=0x777b0000, lpProcName="FlsSetValue") returned 0x778076e6 [0107.044] GetProcAddress (hModule=0x777b0000, lpProcName="InitializeCriticalSectionEx") returned 0x77803879 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="CreateEventExW") returned 0x777b24d8 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="CreateSemaphoreExW") returned 0x777e2111 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="SetThreadStackGuarantee") returned 0x777f2510 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="CreateThreadpoolTimer") returned 0x777eb009 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="SetThreadpoolTimer") returned 0x779089be [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x778fc02a [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="CloseThreadpoolTimer") returned 0x778fc0d2 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="CreateThreadpoolWait") returned 0x777e3f78 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="SetThreadpoolWait") returned 0x77908bfb [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="CloseThreadpoolWait") returned 0x778fb567 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="FlushProcessWriteBuffers") returned 0x77925998 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x778f2251 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="GetCurrentProcessorNumber") returned 0x778f28f6 [0107.045] GetProcAddress (hModule=0x777b0000, lpProcName="GetLogicalProcessorInformation") returned 0x777e2004 [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="CreateSymbolicLinkW") returned 0x77839aa9 [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="EnumSystemLocalesEx") returned 0x7783f3cf [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="CompareStringEx") returned 0x7780ebc6 [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="GetDateFormatEx") returned 0x7784f29f [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="GetLocaleInfoEx") returned 0x777e53a5 [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="GetTimeFormatEx") returned 0x7784f21a [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="GetUserDefaultLocaleName") returned 0x7783f70b [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="IsValidLocaleName") returned 0x7783f71b [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="LCMapStringEx") returned 0x7783f72b [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="GetCurrentPackageId") returned 0x0 [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="GetTickCount64") returned 0x777eeb4e [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0107.046] GetProcAddress (hModule=0x777b0000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0107.047] GetCurrentThreadId () returned 0x94c [0107.047] GetStartupInfoW (in: lpStartupInfo=0xbcfde8 | out: lpStartupInfo=0xbcfde8*(cb=0x44, lpReserved="", lpDesktop="winsta0\\default", lpTitle="taskeng.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x81, wShowWindow=0x4, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x419c4d, hStdOutput=0x7bef9811, hStdError=0x0)) [0107.047] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0107.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0107.048] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0107.048] GetCommandLineW () returned="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe " [0107.048] GetEnvironmentStringsW () returned 0xc72dc8* [0107.048] FreeEnvironmentStringsW (penv=0xc72dc8) returned 1 [0107.048] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4b3ba8, nSize=0x104 | out: lpFilename="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x33 [0107.051] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0107.051] GetLastError () returned 0x0 [0107.051] SetLastError (dwErrCode=0x0) [0107.051] GetLastError () returned 0x0 [0107.051] SetLastError (dwErrCode=0x0) [0107.051] GetLastError () returned 0x0 [0107.051] SetLastError (dwErrCode=0x0) [0107.051] GetACP () returned 0x4e4 [0107.051] GetLastError () returned 0x0 [0107.051] SetLastError (dwErrCode=0x0) [0107.051] IsValidCodePage (CodePage=0x4e4) returned 1 [0107.051] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xbcfddc | out: lpCPInfo=0xbcfddc) returned 1 [0107.051] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xbcf8a4 | out: lpCPInfo=0xbcf8a4) returned 1 [0107.051] GetLastError () returned 0x0 [0107.051] SetLastError (dwErrCode=0x0) [0107.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbcfcb8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0107.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbcfcb8, cbMultiByte=256, lpWideCharStr=0xbcf628, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0107.052] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0xbcf8b8 | out: lpCharType=0xbcf8b8) returned 1 [0107.052] GetLastError () returned 0x0 [0107.052] SetLastError (dwErrCode=0x0) [0107.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbcfcb8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0107.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbcfcb8, cbMultiByte=256, lpWideCharStr=0xbcf5f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0107.052] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0107.052] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xbcf3e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0107.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0xbcfbb8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xe1\x9b\xef\x7b\xf4\xfd\xbc", lpUsedDefaultChar=0x0) returned 256 [0107.052] GetLastError () returned 0x0 [0107.052] SetLastError (dwErrCode=0x0) [0107.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbcfcb8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0107.052] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbcfcb8, cbMultiByte=256, lpWideCharStr=0xbcf608, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0107.052] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0107.052] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xbcf3f8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0107.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0xbcfab8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xe1\x9b\xef\x7b\xf4\xfd\xbc", lpUsedDefaultChar=0x0) returned 256 [0107.052] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0107.052] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424c4c) returned 0x0 [0107.054] GetVersionExW (in: lpVersionInformation=0xbcfcd0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x1f1e1d1c, dwMinorVersion=0x23222120, dwBuildNumber=0x27262524, dwPlatformId=0x9d0013, szCSDVersion="\x04") | out: lpVersionInformation=0xbcfcd0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0107.054] GetCurrentProcess () returned 0xffffffff [0107.054] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0xbcfe20 | out: Wow64Process=0xbcfe20) returned 1 [0107.054] GetSystemInfo (in: lpSystemInfo=0xbcfdec | out: lpSystemInfo=0xbcfdec*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4f01)) [0107.056] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0107.056] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0107.056] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0107.056] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0107.056] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0107.056] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0107.057] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1c2 [0107.060] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0107.060] OleInitialize (pvReserved=0x0) returned 0x0 [0107.069] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0xbcfdf4 | out: phkResult=0xbcfdf4*=0xd8) returned 0x0 [0107.070] RegQueryValueExW (in: hKey=0xd8, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0xbcfe10, lpcbData=0xbcfdf8*=0x8 | out: lpType=0x0, lpData=0xbcfe10*=0x30, lpcbData=0xbcfdf8*=0x4) returned 0x0 [0107.070] RegCloseKey (hKey=0xd8) returned 0x0 [0107.073] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xbafdc8, nSize=0x7fff | out: lpFilename="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x33 [0107.075] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xb9fdb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0107.075] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xbafdd4, lpFilePart=0xbbfdd4 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0xbbfdd4*="RtlUpd64.exe") returned 0x33 [0107.075] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0xbbfdf0 | out: phkResult=0xbbfdf0*=0x0) returned 0x2 [0107.076] IsThemeActive () returned 0x1 [0107.076] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0xbcfe14, fWinIni=0x0 | out: pvParam=0xbcfe14) returned 1 [0107.076] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 0 [0107.076] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xbbfde8 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0107.077] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb9fd48, nSize=0x7fff | out: lpFilename="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x33 [0107.078] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xb8fd38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0107.078] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.078] GetProcAddress (hModule=0x777b0000, lpProcName=0x4a5520) returned 0x777ebc0a [0107.079] Wow64DisableWow64FsRedirection (in: OldValue=0xbafd4c | out: OldValue=0xbafd4c*=0x0) returned 0 [0107.079] FreeLibrary (hLibModule=0x777b0000) returned 1 [0107.080] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xbafbe8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0107.080] GetFileType (hFile=0xd8) returned 0x1 [0107.080] LoadLibraryExW (lpLibFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", hFile=0x0, dwFlags=0x2) returned 0x3f0000 [0107.080] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.080] GetProcAddress (hModule=0x777b0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7783f5f9 [0107.080] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0107.080] FreeLibrary (hLibModule=0x777b0000) returned 1 [0107.081] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xbafda8 | out: ppstm=0xbafda8*=0xc755c8) returned 0x0 [0107.081] FindResourceExW (hModule=0x3f0000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x4b74c8 [0107.081] LoadResource (hModule=0x3f0000, hResInfo=0x4b74c8) returned 0x64d4a0 [0107.081] SizeofResource (hModule=0x3f0000, hResInfo=0x4b74c8) returned 0x17d1c [0107.082] LockResource (hResData=0x64d4a0) returned 0x64d4a0 [0107.082] ISequentialStream:RemoteWrite (in: This=0xc755c8, pv=0x64d4a0*=0xa3, cb=0x17d1c, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0107.086] IStream:RemoteSeek (in: This=0xc755c8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0107.087] IStream:RemoteSeek (in: This=0xc755c8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0107.087] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xc798c0, cb=0x18, pcbRead=0xbafcd4 | out: pv=0xc798c0*=0xa3, pcbRead=0xbafcd4*=0x18) returned 0x0 [0107.087] IStream:RemoteSeek (in: This=0xc755c8, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0107.087] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbafd18, cb=0x4, pcbRead=0xbafcd4 | out: pv=0xbafd18*=0x45, pcbRead=0xbafcd4*=0x4) returned 0x0 [0107.087] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbafd3c, cb=0x10, pcbRead=0xbafd14 | out: pv=0xbafd3c*=0x4d, pcbRead=0xbafd14*=0x10) returned 0x0 [0107.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbafc10 | out: lpSystemTimeAsFileTime=0xbafc10*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.087] IStream:RemoteSeek (in: This=0xc755c8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0107.087] IStream:RemoteSeek (in: This=0xc755c8, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0107.087] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbaf690, cb=0x4, pcbRead=0xbaf454 | out: pv=0xbaf690*=0x6b, pcbRead=0xbaf454*=0x4) returned 0x0 [0107.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbaf350 | out: lpSystemTimeAsFileTime=0xbaf350*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.088] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbaf698, cb=0x4, pcbRead=0xbaf454 | out: pv=0xbaf698*=0xa6, pcbRead=0xbaf454*=0x4) returned 0x0 [0107.088] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbaf480, cb=0x34, pcbRead=0xbaf454 | out: pv=0xbaf480*=0xe1, pcbRead=0xbaf454*=0x34) returned 0x0 [0107.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbaf350 | out: lpSystemTimeAsFileTime=0xbaf350*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.088] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbaf698, cb=0x4, pcbRead=0xbaf454 | out: pv=0xbaf698*=0x1a, pcbRead=0xbaf454*=0x4) returned 0x0 [0107.088] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbaf6c4, cb=0x74, pcbRead=0xbaf454 | out: pv=0xbaf6c4*=0xd, pcbRead=0xbaf454*=0x74) returned 0x0 [0107.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbaf350 | out: lpSystemTimeAsFileTime=0xbaf350*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.088] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbafd4b, cb=0x1, pcbRead=0xbaf69c | out: pv=0xbafd4b*=0x0, pcbRead=0xbaf69c*=0x1) returned 0x0 [0107.088] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbafd44, cb=0x4, pcbRead=0xbaf69c | out: pv=0xbafd44*=0xbc, pcbRead=0xbaf69c*=0x4) returned 0x0 [0107.088] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbafd44, cb=0x4, pcbRead=0xbaf69c | out: pv=0xbafd44*=0xbc, pcbRead=0xbaf69c*=0x4) returned 0x0 [0107.088] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xbafd44, cb=0x4, pcbRead=0xbaf69c | out: pv=0xbafd44*=0x84, pcbRead=0xbaf69c*=0x4) returned 0x0 [0107.088] IStream:RemoteSeek (in: This=0xc755c8, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0107.088] ISequentialStream:RemoteRead (in: This=0xc755c8, pv=0xc74780, cb=0x0, pcbRead=0xbaf69c | out: pv=0xc74780*=0x6e, pcbRead=0xbaf69c*=0x0) returned 0x0 [0107.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbaf598 | out: lpSystemTimeAsFileTime=0xbaf598*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.088] CloseHandle (hObject=0xd8) returned 1 [0107.089] IUnknown:Release (This=0xc755c8) returned 0x0 [0107.089] FreeLibrary (hLibModule=0x3f0000) returned 1 [0107.089] IsDebuggerPresent () returned 0 [0107.089] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xb8fd60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0107.089] GetLongPathNameW (in: lpszShortPath="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpszLongPath=0xb8fd60, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 0x33 [0107.090] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xb8fd30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0107.091] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.091] GetProcAddress (hModule=0x777b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x777ebc0a [0107.091] Wow64DisableWow64FsRedirection (in: OldValue=0xb9fccc | out: OldValue=0xb9fccc*=0x0) returned 0 [0107.091] FreeLibrary (hLibModule=0x777b0000) returned 1 [0107.091] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb9fb68, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0107.091] GetFileType (hFile=0xd8) returned 0x1 [0107.091] LoadLibraryExW (lpLibFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", hFile=0x0, dwFlags=0x2) returned 0x3f0000 [0107.091] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.091] GetProcAddress (hModule=0x777b0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7783f5f9 [0107.091] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0107.091] FreeLibrary (hLibModule=0x777b0000) returned 1 [0107.091] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xb9fcfc | out: ppstm=0xb9fcfc*=0xc756b8) returned 0x0 [0107.092] FindResourceExW (hModule=0x3f0000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x4b74c8 [0107.092] LoadResource (hModule=0x3f0000, hResInfo=0x4b74c8) returned 0x64d4a0 [0107.092] SizeofResource (hModule=0x3f0000, hResInfo=0x4b74c8) returned 0x17d1c [0107.092] LockResource (hResData=0x64d4a0) returned 0x64d4a0 [0107.092] ISequentialStream:RemoteWrite (in: This=0xc756b8, pv=0x64d4a0*=0xa3, cb=0x17d1c, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0107.092] IStream:RemoteSeek (in: This=0xc756b8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0107.092] IStream:RemoteSeek (in: This=0xc756b8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0107.092] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xc79b58, cb=0x18, pcbRead=0xb9fc54 | out: pv=0xc79b58*=0xa3, pcbRead=0xb9fc54*=0x18) returned 0x0 [0107.092] IStream:RemoteSeek (in: This=0xc756b8, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0107.092] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9fc98, cb=0x4, pcbRead=0xb9fc54 | out: pv=0xb9fc98*=0x45, pcbRead=0xb9fc54*=0x4) returned 0x0 [0107.092] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9fcbc, cb=0x10, pcbRead=0xb9fc94 | out: pv=0xb9fcbc*=0x4d, pcbRead=0xb9fc94*=0x10) returned 0x0 [0107.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb9fb90 | out: lpSystemTimeAsFileTime=0xb9fb90*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.092] IStream:RemoteSeek (in: This=0xc756b8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0107.092] IStream:RemoteSeek (in: This=0xc756b8, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0107.092] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f610, cb=0x4, pcbRead=0xb9f3d4 | out: pv=0xb9f610*=0x6b, pcbRead=0xb9f3d4*=0x4) returned 0x0 [0107.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb9f2d0 | out: lpSystemTimeAsFileTime=0xb9f2d0*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f618, cb=0x4, pcbRead=0xb9f3d4 | out: pv=0xb9f618*=0xa6, pcbRead=0xb9f3d4*=0x4) returned 0x0 [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f400, cb=0x34, pcbRead=0xb9f3d4 | out: pv=0xb9f400*=0xe1, pcbRead=0xb9f3d4*=0x34) returned 0x0 [0107.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb9f2d0 | out: lpSystemTimeAsFileTime=0xb9f2d0*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f618, cb=0x4, pcbRead=0xb9f3d4 | out: pv=0xb9f618*=0x1a, pcbRead=0xb9f3d4*=0x4) returned 0x0 [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f644, cb=0x74, pcbRead=0xb9f3d4 | out: pv=0xb9f644*=0xd, pcbRead=0xb9f3d4*=0x74) returned 0x0 [0107.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb9f2d0 | out: lpSystemTimeAsFileTime=0xb9f2d0*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.093] IStream:RemoteSeek (in: This=0xc756b8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f608, cb=0x4, pcbRead=0xb9f3d4 | out: pv=0xb9f608*=0xbc, pcbRead=0xb9f3d4*=0x4) returned 0x0 [0107.093] IStream:RemoteSeek (in: This=0xc756b8, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f610, cb=0x4, pcbRead=0xb9f3d4 | out: pv=0xb9f610*=0x6b, pcbRead=0xb9f3d4*=0x4) returned 0x0 [0107.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb9f2d0 | out: lpSystemTimeAsFileTime=0xb9f2d0*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f618, cb=0x4, pcbRead=0xb9f3d4 | out: pv=0xb9f618*=0xaf, pcbRead=0xb9f3d4*=0x4) returned 0x0 [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f400, cb=0x26, pcbRead=0xb9f3d4 | out: pv=0xb9f400*=0xe6, pcbRead=0xb9f3d4*=0x26) returned 0x0 [0107.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb9f2d0 | out: lpSystemTimeAsFileTime=0xb9f2d0*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f618, cb=0x4, pcbRead=0xb9f3d4 | out: pv=0xb9f618*=0x1e, pcbRead=0xb9f3d4*=0x4) returned 0x0 [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9f644, cb=0x7c, pcbRead=0xb9f3d4 | out: pv=0xb9f644*=0xff, pcbRead=0xb9f3d4*=0x7c) returned 0x0 [0107.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb9f2d0 | out: lpSystemTimeAsFileTime=0xb9f2d0*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9fccb, cb=0x1, pcbRead=0xb9f61c | out: pv=0xb9fccb*=0x1, pcbRead=0xb9f61c*=0x1) returned 0x0 [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9fcc4, cb=0x4, pcbRead=0xb9f61c | out: pv=0xb9fcc4*=0xec, pcbRead=0xb9f61c*=0x4) returned 0x0 [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9fcc4, cb=0x4, pcbRead=0xb9f61c | out: pv=0xb9fcc4*=0x65, pcbRead=0xb9f61c*=0x4) returned 0x0 [0107.093] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xb9fcc4, cb=0x4, pcbRead=0xb9f61c | out: pv=0xb9fcc4*=0x6, pcbRead=0xb9f61c*=0x4) returned 0x0 [0107.093] IStream:RemoteSeek (in: This=0xc756b8, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0107.094] ISequentialStream:RemoteRead (in: This=0xc756b8, pv=0xca18b8, cb=0x17b50, pcbRead=0xb9f61c | out: pv=0xca18b8*=0x6d, pcbRead=0xb9f61c*=0x17b50) returned 0x0 [0107.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb9f518 | out: lpSystemTimeAsFileTime=0xb9f518*(dwLowDateTime=0x2ce004d0, dwHighDateTime=0x1d4b1a5)) [0107.183] CloseHandle (hObject=0xd8) returned 1 [0107.183] IUnknown:Release (This=0xc756b8) returned 0x0 [0107.183] FreeLibrary (hLibModule=0x3f0000) returned 1 [0107.183] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xbafde8, lpFilePart=0xbcfe08 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0xbcfe08*="RtlUpd64.exe") returned 0x33 [0107.185] CharUpperBuffW (in: lpsz="SJFZLYEDBWKTCRUEK", cchLength=0x11 | out: lpsz="SJFZLYEDBWKTCRUEK") returned 0x11 [0107.185] CharUpperBuffW (in: lpsz="EOYHLBQUNPHWLCZHVIPGMR", cchLength=0x16 | out: lpsz="EOYHLBQUNPHWLCZHVIPGMR") returned 0x16 [0107.185] CharUpperBuffW (in: lpsz="EOYHLBQUNPHWLCZHVIPGMR", cchLength=0x16 | out: lpsz="EOYHLBQUNPHWLCZHVIPGMR") returned 0x16 [0107.185] CharUpperBuffW (in: lpsz="DAVCLYVQGTNBHSUXQQGTWIDRKD", cchLength=0x1a | out: lpsz="DAVCLYVQGTNBHSUXQQGTWIDRKD") returned 0x1a [0107.185] CharUpperBuffW (in: lpsz="DAVCLYVQGTNBHSUXQQGTWIDRKD", cchLength=0x1a | out: lpsz="DAVCLYVQGTNBHSUXQQGTWIDRKD") returned 0x1a [0107.185] CharUpperBuffW (in: lpsz="DECDATA", cchLength=0x7 | out: lpsz="DECDATA") returned 0x7 [0107.186] CharUpperBuffW (in: lpsz="DECDATA", cchLength=0x7 | out: lpsz="DECDATA") returned 0x7 [0107.186] CharUpperBuffW (in: lpsz="UAGZWDHRVSWIIOZRGDCPBLBXX", cchLength=0x19 | out: lpsz="UAGZWDHRVSWIIOZRGDCPBLBXX") returned 0x19 [0107.186] CharUpperBuffW (in: lpsz="UAGZWDHRVSWIIOZRGDCPBLBXX", cchLength=0x19 | out: lpsz="UAGZWDHRVSWIIOZRGDCPBLBXX") returned 0x19 [0107.186] CharUpperBuffW (in: lpsz="HQJBCVHQCFCNTHXYDMIHVKRUQEWC", cchLength=0x1c | out: lpsz="HQJBCVHQCFCNTHXYDMIHVKRUQEWC") returned 0x1c [0107.186] CharUpperBuffW (in: lpsz="HQJBCVHQCFCNTHXYDMIHVKRUQEWC", cchLength=0x1c | out: lpsz="HQJBCVHQCFCNTHXYDMIHVKRUQEWC") returned 0x1c [0107.186] CharUpperBuffW (in: lpsz="IGYGYWWHUIQCQOQQYNKW", cchLength=0x14 | out: lpsz="IGYGYWWHUIQCQOQQYNKW") returned 0x14 [0107.186] CharUpperBuffW (in: lpsz="IGYGYWWHUIQCQOQQYNKW", cchLength=0x14 | out: lpsz="IGYGYWWHUIQCQOQQYNKW") returned 0x14 [0107.187] CharUpperBuffW (in: lpsz="VCIKFNQMTNFUTAZVGLPLO", cchLength=0x15 | out: lpsz="VCIKFNQMTNFUTAZVGLPLO") returned 0x15 [0107.187] CharUpperBuffW (in: lpsz="VCIKFNQMTNFUTAZVGLPLO", cchLength=0x15 | out: lpsz="VCIKFNQMTNFUTAZVGLPLO") returned 0x15 [0107.187] CharUpperBuffW (in: lpsz="ANTIEMULATION", cchLength=0xd | out: lpsz="ANTIEMULATION") returned 0xd [0107.187] CharUpperBuffW (in: lpsz="ANTIEMULATION", cchLength=0xd | out: lpsz="ANTIEMULATION") returned 0xd [0107.187] CharUpperBuffW (in: lpsz="CUKXVXVZGVOUEYETKUUTEC", cchLength=0x16 | out: lpsz="CUKXVXVZGVOUEYETKUUTEC") returned 0x16 [0107.187] CharUpperBuffW (in: lpsz="CUKXVXVZGVOUEYETKUUTEC", cchLength=0x16 | out: lpsz="CUKXVXVZGVOUEYETKUUTEC") returned 0x16 [0107.187] CharUpperBuffW (in: lpsz="SYGWYUJDMHO", cchLength=0xb | out: lpsz="SYGWYUJDMHO") returned 0xb [0107.188] CharUpperBuffW (in: lpsz="SYGWYUJDMHO", cchLength=0xb | out: lpsz="SYGWYUJDMHO") returned 0xb [0107.188] CharUpperBuffW (in: lpsz="DDELCTKAWMVJXSIZKVKR", cchLength=0x14 | out: lpsz="DDELCTKAWMVJXSIZKVKR") returned 0x14 [0107.188] CharUpperBuffW (in: lpsz="DDELCTKAWMVJXSIZKVKR", cchLength=0x14 | out: lpsz="DDELCTKAWMVJXSIZKVKR") returned 0x14 [0107.188] CharUpperBuffW (in: lpsz="LAJPUUBTAUPYKYTXN", cchLength=0x11 | out: lpsz="LAJPUUBTAUPYKYTXN") returned 0x11 [0107.188] CharUpperBuffW (in: lpsz="LAJPUUBTAUPYKYTXN", cchLength=0x11 | out: lpsz="LAJPUUBTAUPYKYTXN") returned 0x11 [0107.188] CharUpperBuffW (in: lpsz="TPAGBHUBMCHOAAR", cchLength=0xf | out: lpsz="TPAGBHUBMCHOAAR") returned 0xf [0107.188] CharUpperBuffW (in: lpsz="TPAGBHUBMCHOAAR", cchLength=0xf | out: lpsz="TPAGBHUBMCHOAAR") returned 0xf [0107.189] CharUpperBuffW (in: lpsz="MMPUJJOGMCCXLHZBUFDEPEWFOAU", cchLength=0x1b | out: lpsz="MMPUJJOGMCCXLHZBUFDEPEWFOAU") returned 0x1b [0107.189] CharUpperBuffW (in: lpsz="MMPUJJOGMCCXLHZBUFDEPEWFOAU", cchLength=0x1b | out: lpsz="MMPUJJOGMCCXLHZBUFDEPEWFOAU") returned 0x1b [0107.189] CharUpperBuffW (in: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK", cchLength=0x19 | out: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK") returned 0x19 [0107.189] CharUpperBuffW (in: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK", cchLength=0x19 | out: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK") returned 0x19 [0107.189] CharUpperBuffW (in: lpsz="EYUGCPDIYNRZXLSBKUGV", cchLength=0x14 | out: lpsz="EYUGCPDIYNRZXLSBKUGV") returned 0x14 [0107.189] CharUpperBuffW (in: lpsz="EYUGCPDIYNRZXLSBKUGV", cchLength=0x14 | out: lpsz="EYUGCPDIYNRZXLSBKUGV") returned 0x14 [0107.189] CharUpperBuffW (in: lpsz="VAWBPFJARYLSY_LWN__Z", cchLength=0x14 | out: lpsz="VAWBPFJARYLSY_LWN__Z") returned 0x14 [0107.190] CharUpperBuffW (in: lpsz="VAWBPFJARYLSY_LWN__Z", cchLength=0x14 | out: lpsz="VAWBPFJARYLSY_LWN__Z") returned 0x14 [0107.190] CharUpperBuffW (in: lpsz="PFTJCVYTZWZHJNBFDSVH", cchLength=0x14 | out: lpsz="PFTJCVYTZWZHJNBFDSVH") returned 0x14 [0107.190] CharUpperBuffW (in: lpsz="PFTJCVYTZWZHJNBFDSVH", cchLength=0x14 | out: lpsz="PFTJCVYTZWZHJNBFDSVH") returned 0x14 [0107.190] CharUpperBuffW (in: lpsz="PWGBLLCVBIWPGOVCYHST", cchLength=0x14 | out: lpsz="PWGBLLCVBIWPGOVCYHST") returned 0x14 [0107.190] CharUpperBuffW (in: lpsz="PWGBLLCVBIWPGOVCYHST", cchLength=0x14 | out: lpsz="PWGBLLCVBIWPGOVCYHST") returned 0x14 [0107.190] CharUpperBuffW (in: lpsz="QBAVKKEPMGFRIDJIQFYL", cchLength=0x14 | out: lpsz="QBAVKKEPMGFRIDJIQFYL") returned 0x14 [0107.190] CharUpperBuffW (in: lpsz="QBAVKKEPMGFRIDJIQFYL", cchLength=0x14 | out: lpsz="QBAVKKEPMGFRIDJIQFYL") returned 0x14 [0107.190] CharUpperBuffW (in: lpsz="ZHFSEIECLKQLCIGLUFVW", cchLength=0x14 | out: lpsz="ZHFSEIECLKQLCIGLUFVW") returned 0x14 [0107.191] CharUpperBuffW (in: lpsz="ZHFSEIECLKQLCIGLUFVW", cchLength=0x14 | out: lpsz="ZHFSEIECLKQLCIGLUFVW") returned 0x14 [0107.191] CharUpperBuffW (in: lpsz="ZASLDIOHJDVRTPWQRMGV", cchLength=0x14 | out: lpsz="ZASLDIOHJDVRTPWQRMGV") returned 0x14 [0107.191] CharUpperBuffW (in: lpsz="ZASLDIOHJDVRTPWQRMGV", cchLength=0x14 | out: lpsz="ZASLDIOHJDVRTPWQRMGV") returned 0x14 [0107.191] CharUpperBuffW (in: lpsz="JSKPHBPSKKETVRDBHNYU", cchLength=0x14 | out: lpsz="JSKPHBPSKKETVRDBHNYU") returned 0x14 [0107.191] CharUpperBuffW (in: lpsz="JSKPHBPSKKETVRDBHNYU", cchLength=0x14 | out: lpsz="JSKPHBPSKKETVRDBHNYU") returned 0x14 [0107.191] CharUpperBuffW (in: lpsz="M_INUGTJHWXCPAXMCTAI", cchLength=0x14 | out: lpsz="M_INUGTJHWXCPAXMCTAI") returned 0x14 [0107.191] CharUpperBuffW (in: lpsz="M_INUGTJHWXCPAXMCTAI", cchLength=0x14 | out: lpsz="M_INUGTJHWXCPAXMCTAI") returned 0x14 [0107.191] CharUpperBuffW (in: lpsz="BNSYFESKKKXMBYSQHJIQ", cchLength=0x14 | out: lpsz="BNSYFESKKKXMBYSQHJIQ") returned 0x14 [0107.192] CharUpperBuffW (in: lpsz="BNSYFESKKKXMBYSQHJIQ", cchLength=0x14 | out: lpsz="BNSYFESKKKXMBYSQHJIQ") returned 0x14 [0107.192] CharUpperBuffW (in: lpsz="LSGCAGMKVJRPUYNSDWVN", cchLength=0x14 | out: lpsz="LSGCAGMKVJRPUYNSDWVN") returned 0x14 [0107.192] CharUpperBuffW (in: lpsz="LSGCAGMKVJRPUYNSDWVN", cchLength=0x14 | out: lpsz="LSGCAGMKVJRPUYNSDWVN") returned 0x14 [0107.192] CharUpperBuffW (in: lpsz="FDVIELPYQBHFBSHKWRNV", cchLength=0x14 | out: lpsz="FDVIELPYQBHFBSHKWRNV") returned 0x14 [0107.192] CharUpperBuffW (in: lpsz="FDVIELPYQBHFBSHKWRNV", cchLength=0x14 | out: lpsz="FDVIELPYQBHFBSHKWRNV") returned 0x14 [0107.192] CharUpperBuffW (in: lpsz="ISJEZZKAOCFKNHTKJDQV", cchLength=0x14 | out: lpsz="ISJEZZKAOCFKNHTKJDQV") returned 0x14 [0107.192] CharUpperBuffW (in: lpsz="ISJEZZKAOCFKNHTKJDQV", cchLength=0x14 | out: lpsz="ISJEZZKAOCFKNHTKJDQV") returned 0x14 [0107.192] CharUpperBuffW (in: lpsz="MUSXQUMBQMSLTQRKARJJ", cchLength=0x14 | out: lpsz="MUSXQUMBQMSLTQRKARJJ") returned 0x14 [0107.193] CharUpperBuffW (in: lpsz="MUSXQUMBQMSLTQRKARJJ", cchLength=0x14 | out: lpsz="MUSXQUMBQMSLTQRKARJJ") returned 0x14 [0107.193] CharUpperBuffW (in: lpsz="NOTRRKJGTFVXPFAOQZVF", cchLength=0x14 | out: lpsz="NOTRRKJGTFVXPFAOQZVF") returned 0x14 [0107.193] CharUpperBuffW (in: lpsz="NOTRRKJGTFVXPFAOQZVF", cchLength=0x14 | out: lpsz="NOTRRKJGTFVXPFAOQZVF") returned 0x14 [0107.193] CharUpperBuffW (in: lpsz="JUPVPXOMUFXFQHXUCWSH", cchLength=0x14 | out: lpsz="JUPVPXOMUFXFQHXUCWSH") returned 0x14 [0107.193] CharUpperBuffW (in: lpsz="JUPVPXOMUFXFQHXUCWSH", cchLength=0x14 | out: lpsz="JUPVPXOMUFXFQHXUCWSH") returned 0x14 [0107.193] CharUpperBuffW (in: lpsz="PRASBOPNM_MGRQFGBQCF", cchLength=0x14 | out: lpsz="PRASBOPNM_MGRQFGBQCF") returned 0x14 [0107.193] CharUpperBuffW (in: lpsz="PRASBOPNM_MGRQFGBQCF", cchLength=0x14 | out: lpsz="PRASBOPNM_MGRQFGBQCF") returned 0x14 [0107.193] CharUpperBuffW (in: lpsz="QUUZWZOLIYMFBCZKMNKZ", cchLength=0x14 | out: lpsz="QUUZWZOLIYMFBCZKMNKZ") returned 0x14 [0107.194] CharUpperBuffW (in: lpsz="QUUZWZOLIYMFBCZKMNKZ", cchLength=0x14 | out: lpsz="QUUZWZOLIYMFBCZKMNKZ") returned 0x14 [0107.194] CharUpperBuffW (in: lpsz="NVDECIIZNY_FJETTNKCF", cchLength=0x14 | out: lpsz="NVDECIIZNY_FJETTNKCF") returned 0x14 [0107.194] CharUpperBuffW (in: lpsz="NVDECIIZNY_FJETTNKCF", cchLength=0x14 | out: lpsz="NVDECIIZNY_FJETTNKCF") returned 0x14 [0107.194] CharUpperBuffW (in: lpsz="JCBCSQJKBAHQJLQPHFQD", cchLength=0x14 | out: lpsz="JCBCSQJKBAHQJLQPHFQD") returned 0x14 [0107.194] CharUpperBuffW (in: lpsz="JCBCSQJKBAHQJLQPHFQD", cchLength=0x14 | out: lpsz="JCBCSQJKBAHQJLQPHFQD") returned 0x14 [0107.194] CharUpperBuffW (in: lpsz="KAHBDEOIEXWXMYTRRTOX", cchLength=0x14 | out: lpsz="KAHBDEOIEXWXMYTRRTOX") returned 0x14 [0107.194] CharUpperBuffW (in: lpsz="KAHBDEOIEXWXMYTRRTOX", cchLength=0x14 | out: lpsz="KAHBDEOIEXWXMYTRRTOX") returned 0x14 [0107.194] CharUpperBuffW (in: lpsz="ZHMUXYEMHNIVGJBJDMMF", cchLength=0x14 | out: lpsz="ZHMUXYEMHNIVGJBJDMMF") returned 0x14 [0107.195] CharUpperBuffW (in: lpsz="ZHMUXYEMHNIVGJBJDMMF", cchLength=0x14 | out: lpsz="ZHMUXYEMHNIVGJBJDMMF") returned 0x14 [0107.195] CharUpperBuffW (in: lpsz="VMLKPAFPAPNKNHTCBZRR", cchLength=0x14 | out: lpsz="VMLKPAFPAPNKNHTCBZRR") returned 0x14 [0107.195] CharUpperBuffW (in: lpsz="VMLKPAFPAPNKNHTCBZRR", cchLength=0x14 | out: lpsz="VMLKPAFPAPNKNHTCBZRR") returned 0x14 [0107.195] CharUpperBuffW (in: lpsz="REDKXUVIBQAOCPLAQHXB", cchLength=0x14 | out: lpsz="REDKXUVIBQAOCPLAQHXB") returned 0x14 [0107.195] CharUpperBuffW (in: lpsz="REDKXUVIBQAOCPLAQHXB", cchLength=0x14 | out: lpsz="REDKXUVIBQAOCPLAQHXB") returned 0x14 [0107.195] CharUpperBuffW (in: lpsz="OJTKASVFTSYXKBWX_WNX", cchLength=0x14 | out: lpsz="OJTKASVFTSYXKBWX_WNX") returned 0x14 [0107.195] CharUpperBuffW (in: lpsz="OJTKASVFTSYXKBWX_WNX", cchLength=0x14 | out: lpsz="OJTKASVFTSYXKBWX_WNX") returned 0x14 [0107.195] CharUpperBuffW (in: lpsz="ZAWMLSAXDCXMHRNMO_WJ", cchLength=0x14 | out: lpsz="ZAWMLSAXDCXMHRNMO_WJ") returned 0x14 [0107.196] CharUpperBuffW (in: lpsz="ZAWMLSAXDCXMHRNMO_WJ", cchLength=0x14 | out: lpsz="ZAWMLSAXDCXMHRNMO_WJ") returned 0x14 [0107.196] CharUpperBuffW (in: lpsz="PHPGCBELK_YPOEERMNXJ", cchLength=0x14 | out: lpsz="PHPGCBELK_YPOEERMNXJ") returned 0x14 [0107.196] CharUpperBuffW (in: lpsz="PHPGCBELK_YPOEERMNXJ", cchLength=0x14 | out: lpsz="PHPGCBELK_YPOEERMNXJ") returned 0x14 [0107.196] CharUpperBuffW (in: lpsz="WOCMAOSQEUUABGNESWBM", cchLength=0x14 | out: lpsz="WOCMAOSQEUUABGNESWBM") returned 0x14 [0107.196] CharUpperBuffW (in: lpsz="WOCMAOSQEUUABGNESWBM", cchLength=0x14 | out: lpsz="WOCMAOSQEUUABGNESWBM") returned 0x14 [0107.196] CharUpperBuffW (in: lpsz="KGPWKXXEFKMQLGNWECVG", cchLength=0x14 | out: lpsz="KGPWKXXEFKMQLGNWECVG") returned 0x14 [0107.196] CharUpperBuffW (in: lpsz="KGPWKXXEFKMQLGNWECVG", cchLength=0x14 | out: lpsz="KGPWKXXEFKMQLGNWECVG") returned 0x14 [0107.196] CharUpperBuffW (in: lpsz="MAHKEWEXGTPUVKVEGPO_", cchLength=0x14 | out: lpsz="MAHKEWEXGTPUVKVEGPO_") returned 0x14 [0107.197] CharUpperBuffW (in: lpsz="MAHKEWEXGTPUVKVEGPO_", cchLength=0x14 | out: lpsz="MAHKEWEXGTPUVKVEGPO_") returned 0x14 [0107.197] CharUpperBuffW (in: lpsz="_YWCISGXTVBDUOVXPQMI", cchLength=0x14 | out: lpsz="_YWCISGXTVBDUOVXPQMI") returned 0x14 [0107.197] CharUpperBuffW (in: lpsz="_YWCISGXTVBDUOVXPQMI", cchLength=0x14 | out: lpsz="_YWCISGXTVBDUOVXPQMI") returned 0x14 [0107.197] CharUpperBuffW (in: lpsz="DUZNPLRFXOELYOJWMYRZ", cchLength=0x14 | out: lpsz="DUZNPLRFXOELYOJWMYRZ") returned 0x14 [0107.197] CharUpperBuffW (in: lpsz="DUZNPLRFXOELYOJWMYRZ", cchLength=0x14 | out: lpsz="DUZNPLRFXOELYOJWMYRZ") returned 0x14 [0107.197] CharUpperBuffW (in: lpsz="JXHOFWTYAAIMRXVFTQE_", cchLength=0x14 | out: lpsz="JXHOFWTYAAIMRXVFTQE_") returned 0x14 [0107.197] CharUpperBuffW (in: lpsz="JXHOFWTYAAIMRXVFTQE_", cchLength=0x14 | out: lpsz="JXHOFWTYAAIMRXVFTQE_") returned 0x14 [0107.197] CharUpperBuffW (in: lpsz="SACWIMSIHENVHPTUMXPE", cchLength=0x14 | out: lpsz="SACWIMSIHENVHPTUMXPE") returned 0x14 [0107.198] CharUpperBuffW (in: lpsz="SACWIMSIHENVHPTUMXPE", cchLength=0x14 | out: lpsz="SACWIMSIHENVHPTUMXPE") returned 0x14 [0107.198] CharUpperBuffW (in: lpsz="XUULJMNSYNUPYVWXSZYG", cchLength=0x14 | out: lpsz="XUULJMNSYNUPYVWXSZYG") returned 0x14 [0107.198] CharUpperBuffW (in: lpsz="XUULJMNSYNUPYVWXSZYG", cchLength=0x14 | out: lpsz="XUULJMNSYNUPYVWXSZYG") returned 0x14 [0107.198] CharUpperBuffW (in: lpsz="GSMCLNXRCRDHAXIOWENF", cchLength=0x14 | out: lpsz="GSMCLNXRCRDHAXIOWENF") returned 0x14 [0107.198] CharUpperBuffW (in: lpsz="GSMCLNXRCRDHAXIOWENF", cchLength=0x14 | out: lpsz="GSMCLNXRCRDHAXIOWENF") returned 0x14 [0107.198] CharUpperBuffW (in: lpsz="DLESKBDQQFCHDDDMIDEA", cchLength=0x14 | out: lpsz="DLESKBDQQFCHDDDMIDEA") returned 0x14 [0107.198] CharUpperBuffW (in: lpsz="DLESKBDQQFCHDDDMIDEA", cchLength=0x14 | out: lpsz="DLESKBDQQFCHDDDMIDEA") returned 0x14 [0107.198] CharUpperBuffW (in: lpsz="XHOSXSKKYFMAUHTBFHCA", cchLength=0x14 | out: lpsz="XHOSXSKKYFMAUHTBFHCA") returned 0x14 [0107.199] CharUpperBuffW (in: lpsz="XHOSXSKKYFMAUHTBFHCA", cchLength=0x14 | out: lpsz="XHOSXSKKYFMAUHTBFHCA") returned 0x14 [0107.199] CharUpperBuffW (in: lpsz="_QEYKFIAHEYCACPPUXWV", cchLength=0x14 | out: lpsz="_QEYKFIAHEYCACPPUXWV") returned 0x14 [0107.199] CharUpperBuffW (in: lpsz="_QEYKFIAHEYCACPPUXWV", cchLength=0x14 | out: lpsz="_QEYKFIAHEYCACPPUXWV") returned 0x14 [0107.199] CharUpperBuffW (in: lpsz="M_FBUIIQDAGUAU_RACCL", cchLength=0x14 | out: lpsz="M_FBUIIQDAGUAU_RACCL") returned 0x14 [0107.199] CharUpperBuffW (in: lpsz="M_FBUIIQDAGUAU_RACCL", cchLength=0x14 | out: lpsz="M_FBUIIQDAGUAU_RACCL") returned 0x14 [0107.199] CharUpperBuffW (in: lpsz="NDCHJOSUDZTBTGVUCWDB", cchLength=0x14 | out: lpsz="NDCHJOSUDZTBTGVUCWDB") returned 0x14 [0107.199] CharUpperBuffW (in: lpsz="NDCHJOSUDZTBTGVUCWDB", cchLength=0x14 | out: lpsz="NDCHJOSUDZTBTGVUCWDB") returned 0x14 [0107.199] CharUpperBuffW (in: lpsz="ERXPGKRYZYLSLKZDSACZ", cchLength=0x14 | out: lpsz="ERXPGKRYZYLSLKZDSACZ") returned 0x14 [0107.200] CharUpperBuffW (in: lpsz="ERXPGKRYZYLSLKZDSACZ", cchLength=0x14 | out: lpsz="ERXPGKRYZYLSLKZDSACZ") returned 0x14 [0107.200] CharUpperBuffW (in: lpsz="FZMDXRSNTFQG_ZPUEHLH", cchLength=0x14 | out: lpsz="FZMDXRSNTFQG_ZPUEHLH") returned 0x14 [0107.200] CharUpperBuffW (in: lpsz="FZMDXRSNTFQG_ZPUEHLH", cchLength=0x14 | out: lpsz="FZMDXRSNTFQG_ZPUEHLH") returned 0x14 [0107.200] CharUpperBuffW (in: lpsz="BRMZWPJQKKWFLEAGBXUX", cchLength=0x14 | out: lpsz="BRMZWPJQKKWFLEAGBXUX") returned 0x14 [0107.200] CharUpperBuffW (in: lpsz="BRMZWPJQKKWFLEAGBXUX", cchLength=0x14 | out: lpsz="BRMZWPJQKKWFLEAGBXUX") returned 0x14 [0107.200] CharUpperBuffW (in: lpsz="ETDESII_JCPEKLNFZOOK", cchLength=0x14 | out: lpsz="ETDESII_JCPEKLNFZOOK") returned 0x14 [0107.200] CharUpperBuffW (in: lpsz="ETDESII_JCPEKLNFZOOK", cchLength=0x14 | out: lpsz="ETDESII_JCPEKLNFZOOK") returned 0x14 [0107.200] CharUpperBuffW (in: lpsz="WJNZPVCEXYQAWKKAOPXE", cchLength=0x14 | out: lpsz="WJNZPVCEXYQAWKKAOPXE") returned 0x14 [0107.201] CharUpperBuffW (in: lpsz="WJNZPVCEXYQAWKKAOPXE", cchLength=0x14 | out: lpsz="WJNZPVCEXYQAWKKAOPXE") returned 0x14 [0107.201] CharUpperBuffW (in: lpsz="RZBCABNWUPZLBALLSEYP", cchLength=0x14 | out: lpsz="RZBCABNWUPZLBALLSEYP") returned 0x14 [0107.201] CharUpperBuffW (in: lpsz="RZBCABNWUPZLBALLSEYP", cchLength=0x14 | out: lpsz="RZBCABNWUPZLBALLSEYP") returned 0x14 [0107.201] CharUpperBuffW (in: lpsz="ZU_OYEQNTWHCWPJPGJNX", cchLength=0x14 | out: lpsz="ZU_OYEQNTWHCWPJPGJNX") returned 0x14 [0107.201] CharUpperBuffW (in: lpsz="ZU_OYEQNTWHCWPJPGJNX", cchLength=0x14 | out: lpsz="ZU_OYEQNTWHCWPJPGJNX") returned 0x14 [0107.201] CharUpperBuffW (in: lpsz="GFJLYFLSIGQNQEMTCMBN", cchLength=0x14 | out: lpsz="GFJLYFLSIGQNQEMTCMBN") returned 0x14 [0107.201] CharUpperBuffW (in: lpsz="GFJLYFLSIGQNQEMTCMBN", cchLength=0x14 | out: lpsz="GFJLYFLSIGQNQEMTCMBN") returned 0x14 [0107.201] CharUpperBuffW (in: lpsz="ADRCTQTHUSOPR_NYNBYS", cchLength=0x14 | out: lpsz="ADRCTQTHUSOPR_NYNBYS") returned 0x14 [0107.202] CharUpperBuffW (in: lpsz="ADRCTQTHUSOPR_NYNBYS", cchLength=0x14 | out: lpsz="ADRCTQTHUSOPR_NYNBYS") returned 0x14 [0107.202] CharUpperBuffW (in: lpsz="XYVOCQGEPGTRBENKHFBB", cchLength=0x14 | out: lpsz="XYVOCQGEPGTRBENKHFBB") returned 0x14 [0107.202] CharUpperBuffW (in: lpsz="XYVOCQGEPGTRBENKHFBB", cchLength=0x14 | out: lpsz="XYVOCQGEPGTRBENKHFBB") returned 0x14 [0107.202] CharUpperBuffW (in: lpsz="NKYYMWXNOLVPNJOWSPHU", cchLength=0x14 | out: lpsz="NKYYMWXNOLVPNJOWSPHU") returned 0x14 [0107.202] CharUpperBuffW (in: lpsz="NKYYMWXNOLVPNJOWSPHU", cchLength=0x14 | out: lpsz="NKYYMWXNOLVPNJOWSPHU") returned 0x14 [0107.202] CharUpperBuffW (in: lpsz="NZPZJNK_OOFQCFTPSFQU", cchLength=0x14 | out: lpsz="NZPZJNK_OOFQCFTPSFQU") returned 0x14 [0107.202] CharUpperBuffW (in: lpsz="NZPZJNK_OOFQCFTPSFQU", cchLength=0x14 | out: lpsz="NZPZJNK_OOFQCFTPSFQU") returned 0x14 [0107.202] CharUpperBuffW (in: lpsz="_WDEFSLTADBXLOGIGOKQ", cchLength=0x14 | out: lpsz="_WDEFSLTADBXLOGIGOKQ") returned 0x14 [0107.203] CharUpperBuffW (in: lpsz="_WDEFSLTADBXLOGIGOKQ", cchLength=0x14 | out: lpsz="_WDEFSLTADBXLOGIGOKQ") returned 0x14 [0107.203] CharUpperBuffW (in: lpsz="VDHLJOMTHWSZYHONMRPF", cchLength=0x14 | out: lpsz="VDHLJOMTHWSZYHONMRPF") returned 0x14 [0107.203] CharUpperBuffW (in: lpsz="VDHLJOMTHWSZYHONMRPF", cchLength=0x14 | out: lpsz="VDHLJOMTHWSZYHONMRPF") returned 0x14 [0107.203] CharUpperBuffW (in: lpsz="CQLUJ_MIJQXUMXGTZSLA", cchLength=0x14 | out: lpsz="CQLUJ_MIJQXUMXGTZSLA") returned 0x14 [0107.203] CharUpperBuffW (in: lpsz="CQLUJ_MIJQXUMXGTZSLA", cchLength=0x14 | out: lpsz="CQLUJ_MIJQXUMXGTZSLA") returned 0x14 [0107.203] CharUpperBuffW (in: lpsz="ERJFYBLH_EEKVPIUETBO", cchLength=0x14 | out: lpsz="ERJFYBLH_EEKVPIUETBO") returned 0x14 [0107.203] CharUpperBuffW (in: lpsz="ERJFYBLH_EEKVPIUETBO", cchLength=0x14 | out: lpsz="ERJFYBLH_EEKVPIUETBO") returned 0x14 [0107.203] CharUpperBuffW (in: lpsz="NLYSVERQJQDWHOOLQLYL", cchLength=0x14 | out: lpsz="NLYSVERQJQDWHOOLQLYL") returned 0x14 [0107.204] CharUpperBuffW (in: lpsz="NLYSVERQJQDWHOOLQLYL", cchLength=0x14 | out: lpsz="NLYSVERQJQDWHOOLQLYL") returned 0x14 [0107.204] CharUpperBuffW (in: lpsz="NBOKCHBJGETDUGZSYLQY", cchLength=0x14 | out: lpsz="NBOKCHBJGETDUGZSYLQY") returned 0x14 [0107.204] CharUpperBuffW (in: lpsz="NBOKCHBJGETDUGZSYLQY", cchLength=0x14 | out: lpsz="NBOKCHBJGETDUGZSYLQY") returned 0x14 [0107.204] CharUpperBuffW (in: lpsz="JXHAAZUGXKRTOPRLOCDH", cchLength=0x14 | out: lpsz="JXHAAZUGXKRTOPRLOCDH") returned 0x14 [0107.204] CharUpperBuffW (in: lpsz="JXHAAZUGXKRTOPRLOCDH", cchLength=0x14 | out: lpsz="JXHAAZUGXKRTOPRLOCDH") returned 0x14 [0107.204] CharUpperBuffW (in: lpsz="KRIUJDYJ_INOVOBOWTOE", cchLength=0x14 | out: lpsz="KRIUJDYJ_INOVOBOWTOE") returned 0x14 [0107.204] CharUpperBuffW (in: lpsz="KRIUJDYJ_INOVOBOWTOE", cchLength=0x14 | out: lpsz="KRIUJDYJ_INOVOBOWTOE") returned 0x14 [0107.204] CharUpperBuffW (in: lpsz="JILVZZMFCQJIPRSAQDGA", cchLength=0x14 | out: lpsz="JILVZZMFCQJIPRSAQDGA") returned 0x14 [0107.205] CharUpperBuffW (in: lpsz="JILVZZMFCQJIPRSAQDGA", cchLength=0x14 | out: lpsz="JILVZZMFCQJIPRSAQDGA") returned 0x14 [0107.205] CharUpperBuffW (in: lpsz="SEMOFSJXFIHCUVZS_MIF", cchLength=0x14 | out: lpsz="SEMOFSJXFIHCUVZS_MIF") returned 0x14 [0107.205] CharUpperBuffW (in: lpsz="SEMOFSJXFIHCUVZS_MIF", cchLength=0x14 | out: lpsz="SEMOFSJXFIHCUVZS_MIF") returned 0x14 [0107.205] CharUpperBuffW (in: lpsz="KS_WLIBBMU_BWHTBD_FA", cchLength=0x14 | out: lpsz="KS_WLIBBMU_BWHTBD_FA") returned 0x14 [0107.205] CharUpperBuffW (in: lpsz="KS_WLIBBMU_BWHTBD_FA", cchLength=0x14 | out: lpsz="KS_WLIBBMU_BWHTBD_FA") returned 0x14 [0107.205] CharUpperBuffW (in: lpsz="LBKYTTUGWOPLNRBUXJVF", cchLength=0x14 | out: lpsz="LBKYTTUGWOPLNRBUXJVF") returned 0x14 [0107.205] CharUpperBuffW (in: lpsz="LBKYTTUGWOPLNRBUXJVF", cchLength=0x14 | out: lpsz="LBKYTTUGWOPLNRBUXJVF") returned 0x14 [0107.205] CharUpperBuffW (in: lpsz="GYAAGFSRUS_WEXXHMQDR", cchLength=0x14 | out: lpsz="GYAAGFSRUS_WEXXHMQDR") returned 0x14 [0107.206] CharUpperBuffW (in: lpsz="GYAAGFSRUS_WEXXHMQDR", cchLength=0x14 | out: lpsz="GYAAGFSRUS_WEXXHMQDR") returned 0x14 [0107.206] CharUpperBuffW (in: lpsz="FUKCVTWBKZATQJEONCFE", cchLength=0x14 | out: lpsz="FUKCVTWBKZATQJEONCFE") returned 0x14 [0107.206] CharUpperBuffW (in: lpsz="FUKCVTWBKZATQJEONCFE", cchLength=0x14 | out: lpsz="FUKCVTWBKZATQJEONCFE") returned 0x14 [0107.206] CharUpperBuffW (in: lpsz="PFDZDKAWIWUBSRKHSTXB", cchLength=0x14 | out: lpsz="PFDZDKAWIWUBSRKHSTXB") returned 0x14 [0107.206] CharUpperBuffW (in: lpsz="PFDZDKAWIWUBSRKHSTXB", cchLength=0x14 | out: lpsz="PFDZDKAWIWUBSRKHSTXB") returned 0x14 [0107.206] CharUpperBuffW (in: lpsz="SDHFVWXBSMFLZZLCLCSA", cchLength=0x14 | out: lpsz="SDHFVWXBSMFLZZLCLCSA") returned 0x14 [0107.206] CharUpperBuffW (in: lpsz="SDHFVWXBSMFLZZLCLCSA", cchLength=0x14 | out: lpsz="SDHFVWXBSMFLZZLCLCSA") returned 0x14 [0107.206] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.207] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.207] CharUpperBuffW (in: lpsz="WTDXRHKKKXUKQCKMTZIJ", cchLength=0x14 | out: lpsz="WTDXRHKKKXUKQCKMTZIJ") returned 0x14 [0107.207] CharUpperBuffW (in: lpsz="WTDXRHKKKXUKQCKMTZIJ", cchLength=0x14 | out: lpsz="WTDXRHKKKXUKQCKMTZIJ") returned 0x14 [0107.207] CharUpperBuffW (in: lpsz="QVDTDQKIHNLXDKKOMDSS", cchLength=0x14 | out: lpsz="QVDTDQKIHNLXDKKOMDSS") returned 0x14 [0107.207] CharUpperBuffW (in: lpsz="QVDTDQKIHNLXDKKOMDSS", cchLength=0x14 | out: lpsz="QVDTDQKIHNLXDKKOMDSS") returned 0x14 [0107.207] CharUpperBuffW (in: lpsz="BDRETLGTCOAMGSETKRIV", cchLength=0x14 | out: lpsz="BDRETLGTCOAMGSETKRIV") returned 0x14 [0107.207] CharUpperBuffW (in: lpsz="BDRETLGTCOAMGSETKRIV", cchLength=0x14 | out: lpsz="BDRETLGTCOAMGSETKRIV") returned 0x14 [0107.207] CharUpperBuffW (in: lpsz="OKGOETBUJSOWLZUQGPUN", cchLength=0x14 | out: lpsz="OKGOETBUJSOWLZUQGPUN") returned 0x14 [0107.207] CharUpperBuffW (in: lpsz="OKGOETBUJSOWLZUQGPUN", cchLength=0x14 | out: lpsz="OKGOETBUJSOWLZUQGPUN") returned 0x14 [0107.208] CharUpperBuffW (in: lpsz="SJAGSYGNOFBHGQYVBIAZ", cchLength=0x14 | out: lpsz="SJAGSYGNOFBHGQYVBIAZ") returned 0x14 [0107.208] CharUpperBuffW (in: lpsz="SJAGSYGNOFBHGQYVBIAZ", cchLength=0x14 | out: lpsz="SJAGSYGNOFBHGQYVBIAZ") returned 0x14 [0107.208] CharUpperBuffW (in: lpsz="PKQYPLUXIWNVIUIEYBXY", cchLength=0x14 | out: lpsz="PKQYPLUXIWNVIUIEYBXY") returned 0x14 [0107.208] CharUpperBuffW (in: lpsz="PKQYPLUXIWNVIUIEYBXY", cchLength=0x14 | out: lpsz="PKQYPLUXIWNVIUIEYBXY") returned 0x14 [0107.208] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0107.208] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0107.208] CharUpperBuffW (in: lpsz="JWHXOPFWQMM_RWIDFEIZ", cchLength=0x14 | out: lpsz="JWHXOPFWQMM_RWIDFEIZ") returned 0x14 [0107.208] CharUpperBuffW (in: lpsz="JWHXOPFWQMM_RWIDFEIZ", cchLength=0x14 | out: lpsz="JWHXOPFWQMM_RWIDFEIZ") returned 0x14 [0107.209] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0107.209] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0107.209] CharUpperBuffW (in: lpsz="CLTNRMILWABNEYVBTHMG", cchLength=0x14 | out: lpsz="CLTNRMILWABNEYVBTHMG") returned 0x14 [0107.209] CharUpperBuffW (in: lpsz="CLTNRMILWABNEYVBTHMG", cchLength=0x14 | out: lpsz="CLTNRMILWABNEYVBTHMG") returned 0x14 [0107.209] CharUpperBuffW (in: lpsz="RKOBNPFBPHXZWQZEEFKL", cchLength=0x14 | out: lpsz="RKOBNPFBPHXZWQZEEFKL") returned 0x14 [0107.209] CharUpperBuffW (in: lpsz="RKOBNPFBPHXZWQZEEFKL", cchLength=0x14 | out: lpsz="RKOBNPFBPHXZWQZEEFKL") returned 0x14 [0107.209] CharUpperBuffW (in: lpsz="SSNIKPUAWTSFVFAAUJUJ", cchLength=0x14 | out: lpsz="SSNIKPUAWTSFVFAAUJUJ") returned 0x14 [0107.209] CharUpperBuffW (in: lpsz="SSNIKPUAWTSFVFAAUJUJ", cchLength=0x14 | out: lpsz="SSNIKPUAWTSFVFAAUJUJ") returned 0x14 [0107.210] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0107.210] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0107.210] CharUpperBuffW (in: lpsz="SBWDVAJARWXSENESDBPB", cchLength=0x14 | out: lpsz="SBWDVAJARWXSENESDBPB") returned 0x14 [0107.210] CharUpperBuffW (in: lpsz="SBWDVAJARWXSENESDBPB", cchLength=0x14 | out: lpsz="SBWDVAJARWXSENESDBPB") returned 0x14 [0107.210] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0107.210] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0107.210] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.210] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.211] CharUpperBuffW (in: lpsz="YHNGDJBMMGM_MOVOJOFD", cchLength=0x14 | out: lpsz="YHNGDJBMMGM_MOVOJOFD") returned 0x14 [0107.211] CharUpperBuffW (in: lpsz="YHNGDJBMMGM_MOVOJOFD", cchLength=0x14 | out: lpsz="YHNGDJBMMGM_MOVOJOFD") returned 0x14 [0107.211] CharUpperBuffW (in: lpsz="AWRLSHYJRTOGTGYECYTE", cchLength=0x14 | out: lpsz="AWRLSHYJRTOGTGYECYTE") returned 0x14 [0107.211] CharUpperBuffW (in: lpsz="AWRLSHYJRTOGTGYECYTE", cchLength=0x14 | out: lpsz="AWRLSHYJRTOGTGYECYTE") returned 0x14 [0107.211] CharUpperBuffW (in: lpsz="BTBIGLIXGBUHCJQRWWGP", cchLength=0x14 | out: lpsz="BTBIGLIXGBUHCJQRWWGP") returned 0x14 [0107.212] CharUpperBuffW (in: lpsz="BTBIGLIXGBUHCJQRWWGP", cchLength=0x14 | out: lpsz="BTBIGLIXGBUHCJQRWWGP") returned 0x14 [0107.212] CharUpperBuffW (in: lpsz="GRPZSIBHHZBJMXFNJCJQ", cchLength=0x14 | out: lpsz="GRPZSIBHHZBJMXFNJCJQ") returned 0x14 [0107.212] CharUpperBuffW (in: lpsz="GRPZSIBHHZBJMXFNJCJQ", cchLength=0x14 | out: lpsz="GRPZSIBHHZBJMXFNJCJQ") returned 0x14 [0107.212] CharUpperBuffW (in: lpsz="AMQDEPVGRFKYLKIXWFUE", cchLength=0x14 | out: lpsz="AMQDEPVGRFKYLKIXWFUE") returned 0x14 [0107.212] CharUpperBuffW (in: lpsz="AMQDEPVGRFKYLKIXWFUE", cchLength=0x14 | out: lpsz="AMQDEPVGRFKYLKIXWFUE") returned 0x14 [0107.212] CharUpperBuffW (in: lpsz="DRWKLTSFSUYKEYGFYHQD", cchLength=0x14 | out: lpsz="DRWKLTSFSUYKEYGFYHQD") returned 0x14 [0107.212] CharUpperBuffW (in: lpsz="DRWKLTSFSUYKEYGFYHQD", cchLength=0x14 | out: lpsz="DRWKLTSFSUYKEYGFYHQD") returned 0x14 [0107.212] CharUpperBuffW (in: lpsz="ABKWPVNUENAVQACYEFTI", cchLength=0x14 | out: lpsz="ABKWPVNUENAVQACYEFTI") returned 0x14 [0107.213] CharUpperBuffW (in: lpsz="ABKWPVNUENAVQACYEFTI", cchLength=0x14 | out: lpsz="ABKWPVNUENAVQACYEFTI") returned 0x14 [0107.213] CharUpperBuffW (in: lpsz="SYOGJLMMAYDLTM_CJKEP", cchLength=0x14 | out: lpsz="SYOGJLMMAYDLTM_CJKEP") returned 0x14 [0107.213] CharUpperBuffW (in: lpsz="SYOGJLMMAYDLTM_CJKEP", cchLength=0x14 | out: lpsz="SYOGJLMMAYDLTM_CJKEP") returned 0x14 [0107.213] CharUpperBuffW (in: lpsz="OMEBTERIXFCYORJVKGTE", cchLength=0x14 | out: lpsz="OMEBTERIXFCYORJVKGTE") returned 0x14 [0107.213] CharUpperBuffW (in: lpsz="OMEBTERIXFCYORJVKGTE", cchLength=0x14 | out: lpsz="OMEBTERIXFCYORJVKGTE") returned 0x14 [0107.213] CharUpperBuffW (in: lpsz="KNNAIYDHZSRCVRFNBHZF", cchLength=0x14 | out: lpsz="KNNAIYDHZSRCVRFNBHZF") returned 0x14 [0107.213] CharUpperBuffW (in: lpsz="KNNAIYDHZSRCVRFNBHZF", cchLength=0x14 | out: lpsz="KNNAIYDHZSRCVRFNBHZF") returned 0x14 [0107.213] CharUpperBuffW (in: lpsz="NRFRBMZPG_SQYOMMIAEX", cchLength=0x14 | out: lpsz="NRFRBMZPG_SQYOMMIAEX") returned 0x14 [0107.214] CharUpperBuffW (in: lpsz="NRFRBMZPG_SQYOMMIAEX", cchLength=0x14 | out: lpsz="NRFRBMZPG_SQYOMMIAEX") returned 0x14 [0107.214] CharUpperBuffW (in: lpsz="TSQDPVNBMYTZDXESMLES", cchLength=0x14 | out: lpsz="TSQDPVNBMYTZDXESMLES") returned 0x14 [0107.214] CharUpperBuffW (in: lpsz="TSQDPVNBMYTZDXESMLES", cchLength=0x14 | out: lpsz="TSQDPVNBMYTZDXESMLES") returned 0x14 [0107.214] CharUpperBuffW (in: lpsz="FEWPTOBLLJCUJEHHYGLG", cchLength=0x14 | out: lpsz="FEWPTOBLLJCUJEHHYGLG") returned 0x14 [0107.214] CharUpperBuffW (in: lpsz="FEWPTOBLLJCUJEHHYGLG", cchLength=0x14 | out: lpsz="FEWPTOBLLJCUJEHHYGLG") returned 0x14 [0107.214] CharUpperBuffW (in: lpsz="US_RIYBUCILKFUWUWEDU", cchLength=0x14 | out: lpsz="US_RIYBUCILKFUWUWEDU") returned 0x14 [0107.214] CharUpperBuffW (in: lpsz="US_RIYBUCILKFUWUWEDU", cchLength=0x14 | out: lpsz="US_RIYBUCILKFUWUWEDU") returned 0x14 [0107.214] CharUpperBuffW (in: lpsz="XFSWTCXAHIIWJXZLMYPY", cchLength=0x14 | out: lpsz="XFSWTCXAHIIWJXZLMYPY") returned 0x14 [0107.215] CharUpperBuffW (in: lpsz="XFSWTCXAHIIWJXZLMYPY", cchLength=0x14 | out: lpsz="XFSWTCXAHIIWJXZLMYPY") returned 0x14 [0107.215] CharUpperBuffW (in: lpsz="WONTCZUQCNZAUJHELSBO", cchLength=0x14 | out: lpsz="WONTCZUQCNZAUJHELSBO") returned 0x14 [0107.215] CharUpperBuffW (in: lpsz="WONTCZUQCNZAUJHELSBO", cchLength=0x14 | out: lpsz="WONTCZUQCNZAUJHELSBO") returned 0x14 [0107.215] CharUpperBuffW (in: lpsz="JFTVYKADTXOLYOSYZOAY", cchLength=0x14 | out: lpsz="JFTVYKADTXOLYOSYZOAY") returned 0x14 [0107.215] CharUpperBuffW (in: lpsz="JFTVYKADTXOLYOSYZOAY", cchLength=0x14 | out: lpsz="JFTVYKADTXOLYOSYZOAY") returned 0x14 [0107.215] CharUpperBuffW (in: lpsz="NPEGDBGBJXFHDYAVULHL", cchLength=0x14 | out: lpsz="NPEGDBGBJXFHDYAVULHL") returned 0x14 [0107.215] CharUpperBuffW (in: lpsz="NPEGDBGBJXFHDYAVULHL", cchLength=0x14 | out: lpsz="NPEGDBGBJXFHDYAVULHL") returned 0x14 [0107.215] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0107.216] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0107.216] CharUpperBuffW (in: lpsz="RTVNJRJDKSCKHKDVEEKZ", cchLength=0x14 | out: lpsz="RTVNJRJDKSCKHKDVEEKZ") returned 0x14 [0107.216] CharUpperBuffW (in: lpsz="RTVNJRJDKSCKHKDVEEKZ", cchLength=0x14 | out: lpsz="RTVNJRJDKSCKHKDVEEKZ") returned 0x14 [0107.216] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0107.216] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0107.216] CharUpperBuffW (in: lpsz="NGR_RGYWLIRLFAYSHHJK", cchLength=0x14 | out: lpsz="NGR_RGYWLIRLFAYSHHJK") returned 0x14 [0107.216] CharUpperBuffW (in: lpsz="NGR_RGYWLIRLFAYSHHJK", cchLength=0x14 | out: lpsz="NGR_RGYWLIRLFAYSHHJK") returned 0x14 [0107.216] CharUpperBuffW (in: lpsz="IDXQIICQQWKNZSJCQWXO", cchLength=0x14 | out: lpsz="IDXQIICQQWKNZSJCQWXO") returned 0x14 [0107.217] CharUpperBuffW (in: lpsz="IDXQIICQQWKNZSJCQWXO", cchLength=0x14 | out: lpsz="IDXQIICQQWKNZSJCQWXO") returned 0x14 [0107.217] CharUpperBuffW (in: lpsz="CGLYSV_VMJRNJJTCLUXS", cchLength=0x14 | out: lpsz="CGLYSV_VMJRNJJTCLUXS") returned 0x14 [0107.217] CharUpperBuffW (in: lpsz="CGLYSV_VMJRNJJTCLUXS", cchLength=0x14 | out: lpsz="CGLYSV_VMJRNJJTCLUXS") returned 0x14 [0107.217] CharUpperBuffW (in: lpsz="PRWRLUFYJZWBMKYOBTGF", cchLength=0x14 | out: lpsz="PRWRLUFYJZWBMKYOBTGF") returned 0x14 [0107.217] CharUpperBuffW (in: lpsz="PRWRLUFYJZWBMKYOBTGF", cchLength=0x14 | out: lpsz="PRWRLUFYJZWBMKYOBTGF") returned 0x14 [0107.217] CharUpperBuffW (in: lpsz="BBUTKNHPRBELTCKQDMXZ", cchLength=0x14 | out: lpsz="BBUTKNHPRBELTCKQDMXZ") returned 0x14 [0107.217] CharUpperBuffW (in: lpsz="BBUTKNHPRBELTCKQDMXZ", cchLength=0x14 | out: lpsz="BBUTKNHPRBELTCKQDMXZ") returned 0x14 [0107.217] CharUpperBuffW (in: lpsz="JKCXJTLZTATLTKCPGXKH", cchLength=0x14 | out: lpsz="JKCXJTLZTATLTKCPGXKH") returned 0x14 [0107.218] CharUpperBuffW (in: lpsz="JKCXJTLZTATLTKCPGXKH", cchLength=0x14 | out: lpsz="JKCXJTLZTATLTKCPGXKH") returned 0x14 [0107.218] CharUpperBuffW (in: lpsz="AJYEZDTNOSNQTTEIRRTN", cchLength=0x14 | out: lpsz="AJYEZDTNOSNQTTEIRRTN") returned 0x14 [0107.218] CharUpperBuffW (in: lpsz="AJYEZDTNOSNQTTEIRRTN", cchLength=0x14 | out: lpsz="AJYEZDTNOSNQTTEIRRTN") returned 0x14 [0107.218] CharUpperBuffW (in: lpsz="SKIRTGLRHOFWUQUUQYOD", cchLength=0x14 | out: lpsz="SKIRTGLRHOFWUQUUQYOD") returned 0x14 [0107.218] CharUpperBuffW (in: lpsz="SKIRTGLRHOFWUQUUQYOD", cchLength=0x14 | out: lpsz="SKIRTGLRHOFWUQUUQYOD") returned 0x14 [0107.218] CharUpperBuffW (in: lpsz="DOJZUHTZAPEIUCYQV_CH", cchLength=0x14 | out: lpsz="DOJZUHTZAPEIUCYQV_CH") returned 0x14 [0107.218] CharUpperBuffW (in: lpsz="DOJZUHTZAPEIUCYQV_CH", cchLength=0x14 | out: lpsz="DOJZUHTZAPEIUCYQV_CH") returned 0x14 [0107.218] CharUpperBuffW (in: lpsz="SLAEVLLOVSIVJBMMHQKE", cchLength=0x14 | out: lpsz="SLAEVLLOVSIVJBMMHQKE") returned 0x14 [0107.219] CharUpperBuffW (in: lpsz="SLAEVLLOVSIVJBMMHQKE", cchLength=0x14 | out: lpsz="SLAEVLLOVSIVJBMMHQKE") returned 0x14 [0107.219] CharUpperBuffW (in: lpsz="QVYQNDKGWIKKRWKKWVCQ", cchLength=0x14 | out: lpsz="QVYQNDKGWIKKRWKKWVCQ") returned 0x14 [0107.219] CharUpperBuffW (in: lpsz="QVYQNDKGWIKKRWKKWVCQ", cchLength=0x14 | out: lpsz="QVYQNDKGWIKKRWKKWVCQ") returned 0x14 [0107.219] CharUpperBuffW (in: lpsz="TVASIEJUTJGCLNMPNKIN", cchLength=0x14 | out: lpsz="TVASIEJUTJGCLNMPNKIN") returned 0x14 [0107.219] CharUpperBuffW (in: lpsz="TVASIEJUTJGCLNMPNKIN", cchLength=0x14 | out: lpsz="TVASIEJUTJGCLNMPNKIN") returned 0x14 [0107.219] CharUpperBuffW (in: lpsz="HMWMNGSESHZNGI_ZJEMP", cchLength=0x14 | out: lpsz="HMWMNGSESHZNGI_ZJEMP") returned 0x14 [0107.219] CharUpperBuffW (in: lpsz="HMWMNGSESHZNGI_ZJEMP", cchLength=0x14 | out: lpsz="HMWMNGSESHZNGI_ZJEMP") returned 0x14 [0107.219] CharUpperBuffW (in: lpsz="TWHBKZQUTRXCNIMBHLCT", cchLength=0x14 | out: lpsz="TWHBKZQUTRXCNIMBHLCT") returned 0x14 [0107.220] CharUpperBuffW (in: lpsz="TWHBKZQUTRXCNIMBHLCT", cchLength=0x14 | out: lpsz="TWHBKZQUTRXCNIMBHLCT") returned 0x14 [0107.220] CharUpperBuffW (in: lpsz="MRXYVNNENBQFMGDBQGGV", cchLength=0x14 | out: lpsz="MRXYVNNENBQFMGDBQGGV") returned 0x14 [0107.220] CharUpperBuffW (in: lpsz="MRXYVNNENBQFMGDBQGGV", cchLength=0x14 | out: lpsz="MRXYVNNENBQFMGDBQGGV") returned 0x14 [0107.220] CharUpperBuffW (in: lpsz="HFOVTLOBFNGEQMVYPBQP", cchLength=0x14 | out: lpsz="HFOVTLOBFNGEQMVYPBQP") returned 0x14 [0107.220] CharUpperBuffW (in: lpsz="HFOVTLOBFNGEQMVYPBQP", cchLength=0x14 | out: lpsz="HFOVTLOBFNGEQMVYPBQP") returned 0x14 [0107.220] CharUpperBuffW (in: lpsz="BNN_VUOZHLCAXYVQU_RM", cchLength=0x14 | out: lpsz="BNN_VUOZHLCAXYVQU_RM") returned 0x14 [0107.220] CharUpperBuffW (in: lpsz="BNN_VUOZHLCAXYVQU_RM", cchLength=0x14 | out: lpsz="BNN_VUOZHLCAXYVQU_RM") returned 0x14 [0107.220] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.221] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.221] CharUpperBuffW (in: lpsz="GVMPCHVLDBPFGUDVAUTI", cchLength=0x14 | out: lpsz="GVMPCHVLDBPFGUDVAUTI") returned 0x14 [0107.221] CharUpperBuffW (in: lpsz="GVMPCHVLDBPFGUDVAUTI", cchLength=0x14 | out: lpsz="GVMPCHVLDBPFGUDVAUTI") returned 0x14 [0107.221] CharUpperBuffW (in: lpsz="KVYQGTPSRIDKXHOSWNFL", cchLength=0x14 | out: lpsz="KVYQGTPSRIDKXHOSWNFL") returned 0x14 [0107.221] CharUpperBuffW (in: lpsz="KVYQGTPSRIDKXHOSWNFL", cchLength=0x14 | out: lpsz="KVYQGTPSRIDKXHOSWNFL") returned 0x14 [0107.221] CharUpperBuffW (in: lpsz="XWIXBQLSBNHDNALKQPYB", cchLength=0x14 | out: lpsz="XWIXBQLSBNHDNALKQPYB") returned 0x14 [0107.221] CharUpperBuffW (in: lpsz="XWIXBQLSBNHDNALKQPYB", cchLength=0x14 | out: lpsz="XWIXBQLSBNHDNALKQPYB") returned 0x14 [0107.221] CharUpperBuffW (in: lpsz="CAWVRYLMUYYELQKYLUDR", cchLength=0x14 | out: lpsz="CAWVRYLMUYYELQKYLUDR") returned 0x14 [0107.222] CharUpperBuffW (in: lpsz="CAWVRYLMUYYELQKYLUDR", cchLength=0x14 | out: lpsz="CAWVRYLMUYYELQKYLUDR") returned 0x14 [0107.222] CharUpperBuffW (in: lpsz="VCPXMGLIKRBTBLYCJMWW", cchLength=0x14 | out: lpsz="VCPXMGLIKRBTBLYCJMWW") returned 0x14 [0107.222] CharUpperBuffW (in: lpsz="VCPXMGLIKRBTBLYCJMWW", cchLength=0x14 | out: lpsz="VCPXMGLIKRBTBLYCJMWW") returned 0x14 [0107.222] CharUpperBuffW (in: lpsz="FKJPNAAULJEYFTJHPGRM", cchLength=0x14 | out: lpsz="FKJPNAAULJEYFTJHPGRM") returned 0x14 [0107.222] CharUpperBuffW (in: lpsz="FKJPNAAULJEYFTJHPGRM", cchLength=0x14 | out: lpsz="FKJPNAAULJEYFTJHPGRM") returned 0x14 [0107.222] CharUpperBuffW (in: lpsz="MMBKMWVJWOGCINWBGHEI", cchLength=0x14 | out: lpsz="MMBKMWVJWOGCINWBGHEI") returned 0x14 [0107.222] CharUpperBuffW (in: lpsz="MMBKMWVJWOGCINWBGHEI", cchLength=0x14 | out: lpsz="MMBKMWVJWOGCINWBGHEI") returned 0x14 [0107.222] CharUpperBuffW (in: lpsz="DVDMT_BXXKBFCCNTFGFO", cchLength=0x14 | out: lpsz="DVDMT_BXXKBFCCNTFGFO") returned 0x14 [0107.223] CharUpperBuffW (in: lpsz="DVDMT_BXXKBFCCNTFGFO", cchLength=0x14 | out: lpsz="DVDMT_BXXKBFCCNTFGFO") returned 0x14 [0107.223] CharUpperBuffW (in: lpsz="TEQWXYVQXQTHQMKGBQMX", cchLength=0x14 | out: lpsz="TEQWXYVQXQTHQMKGBQMX") returned 0x14 [0107.223] CharUpperBuffW (in: lpsz="TEQWXYVQXQTHQMKGBQMX", cchLength=0x14 | out: lpsz="TEQWXYVQXQTHQMKGBQMX") returned 0x14 [0107.223] CharUpperBuffW (in: lpsz="IGRXWNKNIDHAGDSCOBSK", cchLength=0x14 | out: lpsz="IGRXWNKNIDHAGDSCOBSK") returned 0x14 [0107.223] CharUpperBuffW (in: lpsz="IGRXWNKNIDHAGDSCOBSK", cchLength=0x14 | out: lpsz="IGRXWNKNIDHAGDSCOBSK") returned 0x14 [0107.223] CharUpperBuffW (in: lpsz="_KGEVVOZKJJCBGPELJNU", cchLength=0x14 | out: lpsz="_KGEVVOZKJJCBGPELJNU") returned 0x14 [0107.223] CharUpperBuffW (in: lpsz="_KGEVVOZKJJCBGPELJNU", cchLength=0x14 | out: lpsz="_KGEVVOZKJJCBGPELJNU") returned 0x14 [0107.223] CharUpperBuffW (in: lpsz="HFUNAXNYPKNZPOOJBABT", cchLength=0x14 | out: lpsz="HFUNAXNYPKNZPOOJBABT") returned 0x14 [0107.224] CharUpperBuffW (in: lpsz="HFUNAXNYPKNZPOOJBABT", cchLength=0x14 | out: lpsz="HFUNAXNYPKNZPOOJBABT") returned 0x14 [0107.224] CharUpperBuffW (in: lpsz="TBIVCLBIASJGMYPGPNKM", cchLength=0x14 | out: lpsz="TBIVCLBIASJGMYPGPNKM") returned 0x14 [0107.224] CharUpperBuffW (in: lpsz="TBIVCLBIASJGMYPGPNKM", cchLength=0x14 | out: lpsz="TBIVCLBIASJGMYPGPNKM") returned 0x14 [0107.224] CharUpperBuffW (in: lpsz="A_VGOSHEMIF_YFFLAXBE", cchLength=0x14 | out: lpsz="A_VGOSHEMIF_YFFLAXBE") returned 0x14 [0107.224] CharUpperBuffW (in: lpsz="A_VGOSHEMIF_YFFLAXBE", cchLength=0x14 | out: lpsz="A_VGOSHEMIF_YFFLAXBE") returned 0x14 [0107.224] CharUpperBuffW (in: lpsz="HJMKOMUFBVOESN_YGRAC", cchLength=0x14 | out: lpsz="HJMKOMUFBVOESN_YGRAC") returned 0x14 [0107.224] CharUpperBuffW (in: lpsz="HJMKOMUFBVOESN_YGRAC", cchLength=0x14 | out: lpsz="HJMKOMUFBVOESN_YGRAC") returned 0x14 [0107.224] CharUpperBuffW (in: lpsz="JISUMVPOAZL_JLZATLNM", cchLength=0x14 | out: lpsz="JISUMVPOAZL_JLZATLNM") returned 0x14 [0107.225] CharUpperBuffW (in: lpsz="JISUMVPOAZL_JLZATLNM", cchLength=0x14 | out: lpsz="JISUMVPOAZL_JLZATLNM") returned 0x14 [0107.225] CharUpperBuffW (in: lpsz="FAMPZFRNGXLXBSAJXLZA", cchLength=0x14 | out: lpsz="FAMPZFRNGXLXBSAJXLZA") returned 0x14 [0107.225] CharUpperBuffW (in: lpsz="FAMPZFRNGXLXBSAJXLZA", cchLength=0x14 | out: lpsz="FAMPZFRNGXLXBSAJXLZA") returned 0x14 [0107.225] CharUpperBuffW (in: lpsz="ECKMEMCHDOSIWWCIKFWC", cchLength=0x14 | out: lpsz="ECKMEMCHDOSIWWCIKFWC") returned 0x14 [0107.225] CharUpperBuffW (in: lpsz="ECKMEMCHDOSIWWCIKFWC", cchLength=0x14 | out: lpsz="ECKMEMCHDOSIWWCIKFWC") returned 0x14 [0107.225] CharUpperBuffW (in: lpsz="_ZCGFXBMZNQJPDKODWUI", cchLength=0x14 | out: lpsz="_ZCGFXBMZNQJPDKODWUI") returned 0x14 [0107.225] CharUpperBuffW (in: lpsz="_ZCGFXBMZNQJPDKODWUI", cchLength=0x14 | out: lpsz="_ZCGFXBMZNQJPDKODWUI") returned 0x14 [0107.225] CharUpperBuffW (in: lpsz="IFVTRKLQDVXTCMCDWCMI", cchLength=0x14 | out: lpsz="IFVTRKLQDVXTCMCDWCMI") returned 0x14 [0107.226] CharUpperBuffW (in: lpsz="IFVTRKLQDVXTCMCDWCMI", cchLength=0x14 | out: lpsz="IFVTRKLQDVXTCMCDWCMI") returned 0x14 [0107.226] CharUpperBuffW (in: lpsz="FT__FJXV_ONADYQWZRHW", cchLength=0x14 | out: lpsz="FT__FJXV_ONADYQWZRHW") returned 0x14 [0107.226] CharUpperBuffW (in: lpsz="FT__FJXV_ONADYQWZRHW", cchLength=0x14 | out: lpsz="FT__FJXV_ONADYQWZRHW") returned 0x14 [0107.226] CharUpperBuffW (in: lpsz="DTJCJZRYGGJJHVBBUMJG", cchLength=0x14 | out: lpsz="DTJCJZRYGGJJHVBBUMJG") returned 0x14 [0107.226] CharUpperBuffW (in: lpsz="DTJCJZRYGGJJHVBBUMJG", cchLength=0x14 | out: lpsz="DTJCJZRYGGJJHVBBUMJG") returned 0x14 [0107.226] CharUpperBuffW (in: lpsz="QHGOOPWKGUOHQKVYDYES", cchLength=0x14 | out: lpsz="QHGOOPWKGUOHQKVYDYES") returned 0x14 [0107.226] CharUpperBuffW (in: lpsz="QHGOOPWKGUOHQKVYDYES", cchLength=0x14 | out: lpsz="QHGOOPWKGUOHQKVYDYES") returned 0x14 [0107.226] CharUpperBuffW (in: lpsz="URONHQRVNUBWEATGZUFO", cchLength=0x14 | out: lpsz="URONHQRVNUBWEATGZUFO") returned 0x14 [0107.227] CharUpperBuffW (in: lpsz="URONHQRVNUBWEATGZUFO", cchLength=0x14 | out: lpsz="URONHQRVNUBWEATGZUFO") returned 0x14 [0107.227] CharUpperBuffW (in: lpsz="DBYPH_KLVNBRGDXOHVKO", cchLength=0x14 | out: lpsz="DBYPH_KLVNBRGDXOHVKO") returned 0x14 [0107.227] CharUpperBuffW (in: lpsz="DBYPH_KLVNBRGDXOHVKO", cchLength=0x14 | out: lpsz="DBYPH_KLVNBRGDXOHVKO") returned 0x14 [0107.227] CharUpperBuffW (in: lpsz="ZGGVWCXEDJQTJHMNMJGB", cchLength=0x14 | out: lpsz="ZGGVWCXEDJQTJHMNMJGB") returned 0x14 [0107.227] CharUpperBuffW (in: lpsz="ZGGVWCXEDJQTJHMNMJGB", cchLength=0x14 | out: lpsz="ZGGVWCXEDJQTJHMNMJGB") returned 0x14 [0107.227] CharUpperBuffW (in: lpsz="WHTIBXLOOYEPETOZJYJH", cchLength=0x14 | out: lpsz="WHTIBXLOOYEPETOZJYJH") returned 0x14 [0107.227] CharUpperBuffW (in: lpsz="WHTIBXLOOYEPETOZJYJH", cchLength=0x14 | out: lpsz="WHTIBXLOOYEPETOZJYJH") returned 0x14 [0107.227] CharUpperBuffW (in: lpsz="RNHUIJIZWMJYXGFIAAUL", cchLength=0x14 | out: lpsz="RNHUIJIZWMJYXGFIAAUL") returned 0x14 [0107.228] CharUpperBuffW (in: lpsz="RNHUIJIZWMJYXGFIAAUL", cchLength=0x14 | out: lpsz="RNHUIJIZWMJYXGFIAAUL") returned 0x14 [0107.228] CharUpperBuffW (in: lpsz="EKVVREXDQUCG_SJXBEUS", cchLength=0x14 | out: lpsz="EKVVREXDQUCG_SJXBEUS") returned 0x14 [0107.228] CharUpperBuffW (in: lpsz="EKVVREXDQUCG_SJXBEUS", cchLength=0x14 | out: lpsz="EKVVREXDQUCG_SJXBEUS") returned 0x14 [0107.228] CharUpperBuffW (in: lpsz="IHBMLZTZASLWWBHCNKKY", cchLength=0x14 | out: lpsz="IHBMLZTZASLWWBHCNKKY") returned 0x14 [0107.228] CharUpperBuffW (in: lpsz="IHBMLZTZASLWWBHCNKKY", cchLength=0x14 | out: lpsz="IHBMLZTZASLWWBHCNKKY") returned 0x14 [0107.228] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.228] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.228] CharUpperBuffW (in: lpsz="NUDYADCXLRRSMFYNGQNQ", cchLength=0x14 | out: lpsz="NUDYADCXLRRSMFYNGQNQ") returned 0x14 [0107.239] CharUpperBuffW (in: lpsz="NUDYADCXLRRSMFYNGQNQ", cchLength=0x14 | out: lpsz="NUDYADCXLRRSMFYNGQNQ") returned 0x14 [0107.240] CharUpperBuffW (in: lpsz="OVNRMJFAAVMIPXZPPROB", cchLength=0x14 | out: lpsz="OVNRMJFAAVMIPXZPPROB") returned 0x14 [0107.240] CharUpperBuffW (in: lpsz="OVNRMJFAAVMIPXZPPROB", cchLength=0x14 | out: lpsz="OVNRMJFAAVMIPXZPPROB") returned 0x14 [0107.240] CharUpperBuffW (in: lpsz="BJLMTQLGRGTBWCILKCIQ", cchLength=0x14 | out: lpsz="BJLMTQLGRGTBWCILKCIQ") returned 0x14 [0107.240] CharUpperBuffW (in: lpsz="BJLMTQLGRGTBWCILKCIQ", cchLength=0x14 | out: lpsz="BJLMTQLGRGTBWCILKCIQ") returned 0x14 [0107.240] CharUpperBuffW (in: lpsz="NVVLEDLWQZQCMBOKPSCF", cchLength=0x14 | out: lpsz="NVVLEDLWQZQCMBOKPSCF") returned 0x14 [0107.240] CharUpperBuffW (in: lpsz="NVVLEDLWQZQCMBOKPSCF", cchLength=0x14 | out: lpsz="NVVLEDLWQZQCMBOKPSCF") returned 0x14 [0107.240] CharUpperBuffW (in: lpsz="FMZXLSJHHMLTZENDAMYM", cchLength=0x14 | out: lpsz="FMZXLSJHHMLTZENDAMYM") returned 0x14 [0107.240] CharUpperBuffW (in: lpsz="FMZXLSJHHMLTZENDAMYM", cchLength=0x14 | out: lpsz="FMZXLSJHHMLTZENDAMYM") returned 0x14 [0107.241] CharUpperBuffW (in: lpsz="SPUTZWGLDAULZAFTWXZV", cchLength=0x14 | out: lpsz="SPUTZWGLDAULZAFTWXZV") returned 0x14 [0107.241] CharUpperBuffW (in: lpsz="SPUTZWGLDAULZAFTWXZV", cchLength=0x14 | out: lpsz="SPUTZWGLDAULZAFTWXZV") returned 0x14 [0107.241] CharUpperBuffW (in: lpsz="GOQEEHSMEPRUOBDQKWUP", cchLength=0x14 | out: lpsz="GOQEEHSMEPRUOBDQKWUP") returned 0x14 [0107.306] CharUpperBuffW (in: lpsz="GOQEEHSMEPRUOBDQKWUP", cchLength=0x14 | out: lpsz="GOQEEHSMEPRUOBDQKWUP") returned 0x14 [0107.306] CharUpperBuffW (in: lpsz="ATLRFHDEHDMGFCQ_MXHD", cchLength=0x14 | out: lpsz="ATLRFHDEHDMGFCQ_MXHD") returned 0x14 [0107.306] CharUpperBuffW (in: lpsz="ATLRFHDEHDMGFCQ_MXHD", cchLength=0x14 | out: lpsz="ATLRFHDEHDMGFCQ_MXHD") returned 0x14 [0107.306] CharUpperBuffW (in: lpsz="FBNVQRDBUQMRSQUPZEVG", cchLength=0x14 | out: lpsz="FBNVQRDBUQMRSQUPZEVG") returned 0x14 [0107.306] CharUpperBuffW (in: lpsz="FBNVQRDBUQMRSQUPZEVG", cchLength=0x14 | out: lpsz="FBNVQRDBUQMRSQUPZEVG") returned 0x14 [0107.306] CharUpperBuffW (in: lpsz="WKOWRNRO___TIJZXLUIE", cchLength=0x14 | out: lpsz="WKOWRNRO___TIJZXLUIE") returned 0x14 [0107.373] CharUpperBuffW (in: lpsz="WKOWRNRO___TIJZXLUIE", cchLength=0x14 | out: lpsz="WKOWRNRO___TIJZXLUIE") returned 0x14 [0107.373] CharUpperBuffW (in: lpsz="KVOVOTDOKRIIMWHEBHMB", cchLength=0x14 | out: lpsz="KVOVOTDOKRIIMWHEBHMB") returned 0x14 [0107.373] CharUpperBuffW (in: lpsz="KVOVOTDOKRIIMWHEBHMB", cchLength=0x14 | out: lpsz="KVOVOTDOKRIIMWHEBHMB") returned 0x14 [0107.373] CharUpperBuffW (in: lpsz="HLIQSXOUCNXEAZCUXEBS", cchLength=0x14 | out: lpsz="HLIQSXOUCNXEAZCUXEBS") returned 0x14 [0107.373] CharUpperBuffW (in: lpsz="HLIQSXOUCNXEAZCUXEBS", cchLength=0x14 | out: lpsz="HLIQSXOUCNXEAZCUXEBS") returned 0x14 [0107.373] CharUpperBuffW (in: lpsz="TGW_L_HZLDXGZPZIRJYY", cchLength=0x14 | out: lpsz="TGW_L_HZLDXGZPZIRJYY") returned 0x14 [0107.373] CharUpperBuffW (in: lpsz="TGW_L_HZLDXGZPZIRJYY", cchLength=0x14 | out: lpsz="TGW_L_HZLDXGZPZIRJYY") returned 0x14 [0107.373] CharUpperBuffW (in: lpsz="PHJZQBHGBLSQFJXCPK_M", cchLength=0x14 | out: lpsz="PHJZQBHGBLSQFJXCPK_M") returned 0x14 [0107.374] CharUpperBuffW (in: lpsz="PHJZQBHGBLSQFJXCPK_M", cchLength=0x14 | out: lpsz="PHJZQBHGBLSQFJXCPK_M") returned 0x14 [0107.374] CharUpperBuffW (in: lpsz="VTPMSRTXCOOHOKDAOXEH", cchLength=0x14 | out: lpsz="VTPMSRTXCOOHOKDAOXEH") returned 0x14 [0107.374] CharUpperBuffW (in: lpsz="VTPMSRTXCOOHOKDAOXEH", cchLength=0x14 | out: lpsz="VTPMSRTXCOOHOKDAOXEH") returned 0x14 [0107.374] CharUpperBuffW (in: lpsz="EBHLYPIUKAVZA_OGNFLT", cchLength=0x14 | out: lpsz="EBHLYPIUKAVZA_OGNFLT") returned 0x14 [0107.374] CharUpperBuffW (in: lpsz="EBHLYPIUKAVZA_OGNFLT", cchLength=0x14 | out: lpsz="EBHLYPIUKAVZA_OGNFLT") returned 0x14 [0107.374] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0107.374] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0107.374] CharUpperBuffW (in: lpsz="PTIWEOWEASVD_VCSIPFW", cchLength=0x14 | out: lpsz="PTIWEOWEASVD_VCSIPFW") returned 0x14 [0107.375] CharUpperBuffW (in: lpsz="PTIWEOWEASVD_VCSIPFW", cchLength=0x14 | out: lpsz="PTIWEOWEASVD_VCSIPFW") returned 0x14 [0107.375] CharUpperBuffW (in: lpsz="_MIJJBAKZIYTPWIRUNSM", cchLength=0x14 | out: lpsz="_MIJJBAKZIYTPWIRUNSM") returned 0x14 [0107.375] CharUpperBuffW (in: lpsz="_MIJJBAKZIYTPWIRUNSM", cchLength=0x14 | out: lpsz="_MIJJBAKZIYTPWIRUNSM") returned 0x14 [0107.375] CharUpperBuffW (in: lpsz="ISXEVJELOZPMFPUUWN_M", cchLength=0x14 | out: lpsz="ISXEVJELOZPMFPUUWN_M") returned 0x14 [0107.375] CharUpperBuffW (in: lpsz="ISXEVJELOZPMFPUUWN_M", cchLength=0x14 | out: lpsz="ISXEVJELOZPMFPUUWN_M") returned 0x14 [0107.375] CharUpperBuffW (in: lpsz="NUUVN_ACCRGZTONJQDDN", cchLength=0x14 | out: lpsz="NUUVN_ACCRGZTONJQDDN") returned 0x14 [0107.375] CharUpperBuffW (in: lpsz="NUUVN_ACCRGZTONJQDDN", cchLength=0x14 | out: lpsz="NUUVN_ACCRGZTONJQDDN") returned 0x14 [0107.375] CharUpperBuffW (in: lpsz="MPUHLDKUBDWWLTDIERUE", cchLength=0x14 | out: lpsz="MPUHLDKUBDWWLTDIERUE") returned 0x14 [0107.376] CharUpperBuffW (in: lpsz="MPUHLDKUBDWWLTDIERUE", cchLength=0x14 | out: lpsz="MPUHLDKUBDWWLTDIERUE") returned 0x14 [0107.376] CharUpperBuffW (in: lpsz="KPEAKNKTUNERIHXLHQPR", cchLength=0x14 | out: lpsz="KPEAKNKTUNERIHXLHQPR") returned 0x14 [0107.376] CharUpperBuffW (in: lpsz="KPEAKNKTUNERIHXLHQPR", cchLength=0x14 | out: lpsz="KPEAKNKTUNERIHXLHQPR") returned 0x14 [0107.376] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0107.376] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0107.376] CharUpperBuffW (in: lpsz="YHPSZRIJQJDLOVRNSRMY", cchLength=0x14 | out: lpsz="YHPSZRIJQJDLOVRNSRMY") returned 0x14 [0107.376] CharUpperBuffW (in: lpsz="YHPSZRIJQJDLOVRNSRMY", cchLength=0x14 | out: lpsz="YHPSZRIJQJDLOVRNSRMY") returned 0x14 [0107.376] CharUpperBuffW (in: lpsz="YYKFZMEHTHMRTTIZAYIK", cchLength=0x14 | out: lpsz="YYKFZMEHTHMRTTIZAYIK") returned 0x14 [0107.377] CharUpperBuffW (in: lpsz="YYKFZMEHTHMRTTIZAYIK", cchLength=0x14 | out: lpsz="YYKFZMEHTHMRTTIZAYIK") returned 0x14 [0107.377] CharUpperBuffW (in: lpsz="XLLSVSFYSDLDRRVKAWOL", cchLength=0x14 | out: lpsz="XLLSVSFYSDLDRRVKAWOL") returned 0x14 [0107.377] CharUpperBuffW (in: lpsz="XLLSVSFYSDLDRRVKAWOL", cchLength=0x14 | out: lpsz="XLLSVSFYSDLDRRVKAWOL") returned 0x14 [0107.377] CharUpperBuffW (in: lpsz="OCZOSOO_VZBANTXFMYTA", cchLength=0x14 | out: lpsz="OCZOSOO_VZBANTXFMYTA") returned 0x14 [0107.377] CharUpperBuffW (in: lpsz="OCZOSOO_VZBANTXFMYTA", cchLength=0x14 | out: lpsz="OCZOSOO_VZBANTXFMYTA") returned 0x14 [0107.377] CharUpperBuffW (in: lpsz="RNVFZJYOJHYGNWHJITMW", cchLength=0x14 | out: lpsz="RNVFZJYOJHYGNWHJITMW") returned 0x14 [0107.377] CharUpperBuffW (in: lpsz="RNVFZJYOJHYGNWHJITMW", cchLength=0x14 | out: lpsz="RNVFZJYOJHYGNWHJITMW") returned 0x14 [0107.377] CharUpperBuffW (in: lpsz="AOBCXARUGBAVBBAVHCGC", cchLength=0x14 | out: lpsz="AOBCXARUGBAVBBAVHCGC") returned 0x14 [0107.378] CharUpperBuffW (in: lpsz="AOBCXARUGBAVBBAVHCGC", cchLength=0x14 | out: lpsz="AOBCXARUGBAVBBAVHCGC") returned 0x14 [0107.378] CharUpperBuffW (in: lpsz="Q_LFLBOXJUIHZMESROBD", cchLength=0x14 | out: lpsz="Q_LFLBOXJUIHZMESROBD") returned 0x14 [0107.378] CharUpperBuffW (in: lpsz="Q_LFLBOXJUIHZMESROBD", cchLength=0x14 | out: lpsz="Q_LFLBOXJUIHZMESROBD") returned 0x14 [0107.378] CharUpperBuffW (in: lpsz="DIRCGVCYOUQJGIAZYVGM", cchLength=0x14 | out: lpsz="DIRCGVCYOUQJGIAZYVGM") returned 0x14 [0107.378] CharUpperBuffW (in: lpsz="DIRCGVCYOUQJGIAZYVGM", cchLength=0x14 | out: lpsz="DIRCGVCYOUQJGIAZYVGM") returned 0x14 [0107.378] CharUpperBuffW (in: lpsz="JOJZCHXEYSELNQUOZTIM", cchLength=0x14 | out: lpsz="JOJZCHXEYSELNQUOZTIM") returned 0x14 [0107.378] CharUpperBuffW (in: lpsz="JOJZCHXEYSELNQUOZTIM", cchLength=0x14 | out: lpsz="JOJZCHXEYSELNQUOZTIM") returned 0x14 [0107.378] CharUpperBuffW (in: lpsz="ZXL_EVRZLHUQLQPMJKXE", cchLength=0x14 | out: lpsz="ZXL_EVRZLHUQLQPMJKXE") returned 0x14 [0107.379] CharUpperBuffW (in: lpsz="ZXL_EVRZLHUQLQPMJKXE", cchLength=0x14 | out: lpsz="ZXL_EVRZLHUQLQPMJKXE") returned 0x14 [0107.379] CharUpperBuffW (in: lpsz="DLAAVYZCQGXMSOLNZMZB", cchLength=0x14 | out: lpsz="DLAAVYZCQGXMSOLNZMZB") returned 0x14 [0107.379] CharUpperBuffW (in: lpsz="DLAAVYZCQGXMSOLNZMZB", cchLength=0x14 | out: lpsz="DLAAVYZCQGXMSOLNZMZB") returned 0x14 [0107.379] CharUpperBuffW (in: lpsz="ZYPUBSLFSVZSLWIQEIDR", cchLength=0x14 | out: lpsz="ZYPUBSLFSVZSLWIQEIDR") returned 0x14 [0107.379] CharUpperBuffW (in: lpsz="ZYPUBSLFSVZSLWIQEIDR", cchLength=0x14 | out: lpsz="ZYPUBSLFSVZSLWIQEIDR") returned 0x14 [0107.379] CharUpperBuffW (in: lpsz="BSBAWZNDNTYYFU_IBHZS", cchLength=0x14 | out: lpsz="BSBAWZNDNTYYFU_IBHZS") returned 0x14 [0107.379] CharUpperBuffW (in: lpsz="BSBAWZNDNTYYFU_IBHZS", cchLength=0x14 | out: lpsz="BSBAWZNDNTYYFU_IBHZS") returned 0x14 [0107.379] CharUpperBuffW (in: lpsz="LQVDQPQEOBAKVEZUEERG", cchLength=0x14 | out: lpsz="LQVDQPQEOBAKVEZUEERG") returned 0x14 [0107.380] CharUpperBuffW (in: lpsz="LQVDQPQEOBAKVEZUEERG", cchLength=0x14 | out: lpsz="LQVDQPQEOBAKVEZUEERG") returned 0x14 [0107.380] CharUpperBuffW (in: lpsz="ZNQMQJYARTCFEMTWJIHR", cchLength=0x14 | out: lpsz="ZNQMQJYARTCFEMTWJIHR") returned 0x14 [0107.380] CharUpperBuffW (in: lpsz="ZNQMQJYARTCFEMTWJIHR", cchLength=0x14 | out: lpsz="ZNQMQJYARTCFEMTWJIHR") returned 0x14 [0107.380] CharUpperBuffW (in: lpsz="FLDM_QGWQIEKXWDTBRDB", cchLength=0x14 | out: lpsz="FLDM_QGWQIEKXWDTBRDB") returned 0x14 [0107.380] CharUpperBuffW (in: lpsz="FLDM_QGWQIEKXWDTBRDB", cchLength=0x14 | out: lpsz="FLDM_QGWQIEKXWDTBRDB") returned 0x14 [0107.380] CharUpperBuffW (in: lpsz="QEFZWQPGSAHIFLGQVXV_", cchLength=0x14 | out: lpsz="QEFZWQPGSAHIFLGQVXV_") returned 0x14 [0107.380] CharUpperBuffW (in: lpsz="QEFZWQPGSAHIFLGQVXV_", cchLength=0x14 | out: lpsz="QEFZWQPGSAHIFLGQVXV_") returned 0x14 [0107.380] CharUpperBuffW (in: lpsz="HSLWTF_FMHKWUUJGRQPF", cchLength=0x14 | out: lpsz="HSLWTF_FMHKWUUJGRQPF") returned 0x14 [0107.381] CharUpperBuffW (in: lpsz="HSLWTF_FMHKWUUJGRQPF", cchLength=0x14 | out: lpsz="HSLWTF_FMHKWUUJGRQPF") returned 0x14 [0107.381] CharUpperBuffW (in: lpsz="ADJGKGMBRAQZFE_WYFMC", cchLength=0x14 | out: lpsz="ADJGKGMBRAQZFE_WYFMC") returned 0x14 [0107.381] CharUpperBuffW (in: lpsz="ADJGKGMBRAQZFE_WYFMC", cchLength=0x14 | out: lpsz="ADJGKGMBRAQZFE_WYFMC") returned 0x14 [0107.381] CharUpperBuffW (in: lpsz="RHKCGUIZTHACOFKJWGPY", cchLength=0x14 | out: lpsz="RHKCGUIZTHACOFKJWGPY") returned 0x14 [0107.381] CharUpperBuffW (in: lpsz="RHKCGUIZTHACOFKJWGPY", cchLength=0x14 | out: lpsz="RHKCGUIZTHACOFKJWGPY") returned 0x14 [0107.381] CharUpperBuffW (in: lpsz="XALBCOZOUUDGAIXIQMWV", cchLength=0x14 | out: lpsz="XALBCOZOUUDGAIXIQMWV") returned 0x14 [0107.381] CharUpperBuffW (in: lpsz="XALBCOZOUUDGAIXIQMWV", cchLength=0x14 | out: lpsz="XALBCOZOUUDGAIXIQMWV") returned 0x14 [0107.381] CharUpperBuffW (in: lpsz="TE__JWNSXGEHGPPFMNCK", cchLength=0x14 | out: lpsz="TE__JWNSXGEHGPPFMNCK") returned 0x14 [0107.382] CharUpperBuffW (in: lpsz="TE__JWNSXGEHGPPFMNCK", cchLength=0x14 | out: lpsz="TE__JWNSXGEHGPPFMNCK") returned 0x14 [0107.382] CharUpperBuffW (in: lpsz="NTJQCSZDHNUWDALIU_JH", cchLength=0x14 | out: lpsz="NTJQCSZDHNUWDALIU_JH") returned 0x14 [0107.382] CharUpperBuffW (in: lpsz="NTJQCSZDHNUWDALIU_JH", cchLength=0x14 | out: lpsz="NTJQCSZDHNUWDALIU_JH") returned 0x14 [0107.382] CharUpperBuffW (in: lpsz="EOFPISWVZELPYTRELMNQ", cchLength=0x14 | out: lpsz="EOFPISWVZELPYTRELMNQ") returned 0x14 [0107.382] CharUpperBuffW (in: lpsz="EOFPISWVZELPYTRELMNQ", cchLength=0x14 | out: lpsz="EOFPISWVZELPYTRELMNQ") returned 0x14 [0107.382] CharUpperBuffW (in: lpsz="DFUSZUZNKUVVAQ_OOESL", cchLength=0x14 | out: lpsz="DFUSZUZNKUVVAQ_OOESL") returned 0x14 [0107.382] CharUpperBuffW (in: lpsz="DFUSZUZNKUVVAQ_OOESL", cchLength=0x14 | out: lpsz="DFUSZUZNKUVVAQ_OOESL") returned 0x14 [0107.383] CharUpperBuffW (in: lpsz="HQGJHNQBJP_BLS_VUEPT", cchLength=0x14 | out: lpsz="HQGJHNQBJP_BLS_VUEPT") returned 0x14 [0107.383] CharUpperBuffW (in: lpsz="HQGJHNQBJP_BLS_VUEPT", cchLength=0x14 | out: lpsz="HQGJHNQBJP_BLS_VUEPT") returned 0x14 [0107.383] CharUpperBuffW (in: lpsz="IXJEARQUQLJKDRZVETNC", cchLength=0x14 | out: lpsz="IXJEARQUQLJKDRZVETNC") returned 0x14 [0107.383] CharUpperBuffW (in: lpsz="IXJEARQUQLJKDRZVETNC", cchLength=0x14 | out: lpsz="IXJEARQUQLJKDRZVETNC") returned 0x14 [0107.383] CharUpperBuffW (in: lpsz="R_HXSMTQHZMLOY_OVNVQ", cchLength=0x14 | out: lpsz="R_HXSMTQHZMLOY_OVNVQ") returned 0x14 [0107.383] CharUpperBuffW (in: lpsz="R_HXSMTQHZMLOY_OVNVQ", cchLength=0x14 | out: lpsz="R_HXSMTQHZMLOY_OVNVQ") returned 0x14 [0107.383] CharUpperBuffW (in: lpsz="IOWEKEVXKVBSQYBFFHAC", cchLength=0x14 | out: lpsz="IOWEKEVXKVBSQYBFFHAC") returned 0x14 [0107.383] CharUpperBuffW (in: lpsz="IOWEKEVXKVBSQYBFFHAC", cchLength=0x14 | out: lpsz="IOWEKEVXKVBSQYBFFHAC") returned 0x14 [0107.384] CharUpperBuffW (in: lpsz="ZWVOLVHCXTTABYIH_QIK", cchLength=0x14 | out: lpsz="ZWVOLVHCXTTABYIH_QIK") returned 0x14 [0107.384] CharUpperBuffW (in: lpsz="ZWVOLVHCXTTABYIH_QIK", cchLength=0x14 | out: lpsz="ZWVOLVHCXTTABYIH_QIK") returned 0x14 [0107.384] CharUpperBuffW (in: lpsz="YGZNUTVLBTUIUMORDGXG", cchLength=0x14 | out: lpsz="YGZNUTVLBTUIUMORDGXG") returned 0x14 [0107.384] CharUpperBuffW (in: lpsz="YGZNUTVLBTUIUMORDGXG", cchLength=0x14 | out: lpsz="YGZNUTVLBTUIUMORDGXG") returned 0x14 [0107.384] CharUpperBuffW (in: lpsz="YCOQJF_WCPMLCUJOZPEM", cchLength=0x14 | out: lpsz="YCOQJF_WCPMLCUJOZPEM") returned 0x14 [0107.384] CharUpperBuffW (in: lpsz="YCOQJF_WCPMLCUJOZPEM", cchLength=0x14 | out: lpsz="YCOQJF_WCPMLCUJOZPEM") returned 0x14 [0107.384] CharUpperBuffW (in: lpsz="PBCXQ_NYSQLKXTQ_MXRH", cchLength=0x14 | out: lpsz="PBCXQ_NYSQLKXTQ_MXRH") returned 0x14 [0107.384] CharUpperBuffW (in: lpsz="PBCXQ_NYSQLKXTQ_MXRH", cchLength=0x14 | out: lpsz="PBCXQ_NYSQLKXTQ_MXRH") returned 0x14 [0107.385] CharUpperBuffW (in: lpsz="GTQVUATOAAGUKZQXRXAS", cchLength=0x14 | out: lpsz="GTQVUATOAAGUKZQXRXAS") returned 0x14 [0107.385] CharUpperBuffW (in: lpsz="GTQVUATOAAGUKZQXRXAS", cchLength=0x14 | out: lpsz="GTQVUATOAAGUKZQXRXAS") returned 0x14 [0107.385] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.385] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.385] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.385] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.385] CharUpperBuffW (in: lpsz="YBURDCYGDWATQEEEPMID", cchLength=0x14 | out: lpsz="YBURDCYGDWATQEEEPMID") returned 0x14 [0107.385] CharUpperBuffW (in: lpsz="YBURDCYGDWATQEEEPMID", cchLength=0x14 | out: lpsz="YBURDCYGDWATQEEEPMID") returned 0x14 [0107.386] CharUpperBuffW (in: lpsz="LVHRFAHBOPRTUFPMRKFA", cchLength=0x14 | out: lpsz="LVHRFAHBOPRTUFPMRKFA") returned 0x14 [0107.386] CharUpperBuffW (in: lpsz="LVHRFAHBOPRTUFPMRKFA", cchLength=0x14 | out: lpsz="LVHRFAHBOPRTUFPMRKFA") returned 0x14 [0107.386] CharUpperBuffW (in: lpsz="VPMTSGRTYAWJBNTCAFQV", cchLength=0x14 | out: lpsz="VPMTSGRTYAWJBNTCAFQV") returned 0x14 [0107.386] CharUpperBuffW (in: lpsz="VPMTSGRTYAWJBNTCAFQV", cchLength=0x14 | out: lpsz="VPMTSGRTYAWJBNTCAFQV") returned 0x14 [0107.386] CharUpperBuffW (in: lpsz="SPPTUPHEFIFRPFIUJWPE", cchLength=0x14 | out: lpsz="SPPTUPHEFIFRPFIUJWPE") returned 0x14 [0107.386] CharUpperBuffW (in: lpsz="SPPTUPHEFIFRPFIUJWPE", cchLength=0x14 | out: lpsz="SPPTUPHEFIFRPFIUJWPE") returned 0x14 [0107.386] CharUpperBuffW (in: lpsz="YHDHNWJXFYSBOTMCLCCK", cchLength=0x14 | out: lpsz="YHDHNWJXFYSBOTMCLCCK") returned 0x14 [0107.386] CharUpperBuffW (in: lpsz="YHDHNWJXFYSBOTMCLCCK", cchLength=0x14 | out: lpsz="YHDHNWJXFYSBOTMCLCCK") returned 0x14 [0107.387] CharUpperBuffW (in: lpsz="HBCXYPGZJYUIEUOFONZL", cchLength=0x14 | out: lpsz="HBCXYPGZJYUIEUOFONZL") returned 0x14 [0107.387] CharUpperBuffW (in: lpsz="HBCXYPGZJYUIEUOFONZL", cchLength=0x14 | out: lpsz="HBCXYPGZJYUIEUOFONZL") returned 0x14 [0107.387] CharUpperBuffW (in: lpsz="KMFBYHCLQKWBVOTTPPUI", cchLength=0x14 | out: lpsz="KMFBYHCLQKWBVOTTPPUI") returned 0x14 [0107.387] CharUpperBuffW (in: lpsz="KMFBYHCLQKWBVOTTPPUI", cchLength=0x14 | out: lpsz="KMFBYHCLQKWBVOTTPPUI") returned 0x14 [0107.387] CharUpperBuffW (in: lpsz="NPMWIEBZ_ZJZDZJGPRCB", cchLength=0x14 | out: lpsz="NPMWIEBZ_ZJZDZJGPRCB") returned 0x14 [0107.387] CharUpperBuffW (in: lpsz="NPMWIEBZ_ZJZDZJGPRCB", cchLength=0x14 | out: lpsz="NPMWIEBZ_ZJZDZJGPRCB") returned 0x14 [0107.387] CharUpperBuffW (in: lpsz="FHAKUYOMQHQPYRQEESDU", cchLength=0x14 | out: lpsz="FHAKUYOMQHQPYRQEESDU") returned 0x14 [0107.387] CharUpperBuffW (in: lpsz="FHAKUYOMQHQPYRQEESDU", cchLength=0x14 | out: lpsz="FHAKUYOMQHQPYRQEESDU") returned 0x14 [0107.388] CharUpperBuffW (in: lpsz="FGFFXQKHKEKMQEASRIFD", cchLength=0x14 | out: lpsz="FGFFXQKHKEKMQEASRIFD") returned 0x14 [0107.388] CharUpperBuffW (in: lpsz="FGFFXQKHKEKMQEASRIFD", cchLength=0x14 | out: lpsz="FGFFXQKHKEKMQEASRIFD") returned 0x14 [0107.388] CharUpperBuffW (in: lpsz="LJWSHLJQLYCSCLLVIZWX", cchLength=0x14 | out: lpsz="LJWSHLJQLYCSCLLVIZWX") returned 0x14 [0107.388] CharUpperBuffW (in: lpsz="LJWSHLJQLYCSCLLVIZWX", cchLength=0x14 | out: lpsz="LJWSHLJQLYCSCLLVIZWX") returned 0x14 [0107.388] CharUpperBuffW (in: lpsz="LMGXO__VIDUBLBNQ_URO", cchLength=0x14 | out: lpsz="LMGXO__VIDUBLBNQ_URO") returned 0x14 [0107.388] CharUpperBuffW (in: lpsz="LMGXO__VIDUBLBNQ_URO", cchLength=0x14 | out: lpsz="LMGXO__VIDUBLBNQ_URO") returned 0x14 [0107.388] CharUpperBuffW (in: lpsz="KUJEVWMGAPXSFGHGYTMN", cchLength=0x14 | out: lpsz="KUJEVWMGAPXSFGHGYTMN") returned 0x14 [0107.388] CharUpperBuffW (in: lpsz="KUJEVWMGAPXSFGHGYTMN", cchLength=0x14 | out: lpsz="KUJEVWMGAPXSFGHGYTMN") returned 0x14 [0107.389] CharUpperBuffW (in: lpsz="ZFRTZZSAHZYYERUFUTKH", cchLength=0x14 | out: lpsz="ZFRTZZSAHZYYERUFUTKH") returned 0x14 [0107.389] CharUpperBuffW (in: lpsz="ZFRTZZSAHZYYERUFUTKH", cchLength=0x14 | out: lpsz="ZFRTZZSAHZYYERUFUTKH") returned 0x14 [0107.389] CharUpperBuffW (in: lpsz="VFTWGGPLXGJNWOXXDP_N", cchLength=0x14 | out: lpsz="VFTWGGPLXGJNWOXXDP_N") returned 0x14 [0107.389] CharUpperBuffW (in: lpsz="VFTWGGPLXGJNWOXXDP_N", cchLength=0x14 | out: lpsz="VFTWGGPLXGJNWOXXDP_N") returned 0x14 [0107.389] CharUpperBuffW (in: lpsz="QHLVF_UXMS_ZKTPJHBHM", cchLength=0x14 | out: lpsz="QHLVF_UXMS_ZKTPJHBHM") returned 0x14 [0107.389] CharUpperBuffW (in: lpsz="QHLVF_UXMS_ZKTPJHBHM", cchLength=0x14 | out: lpsz="QHLVF_UXMS_ZKTPJHBHM") returned 0x14 [0107.389] CharUpperBuffW (in: lpsz="HWIRORBETUPRHDGLYFQB", cchLength=0x14 | out: lpsz="HWIRORBETUPRHDGLYFQB") returned 0x14 [0107.389] CharUpperBuffW (in: lpsz="HWIRORBETUPRHDGLYFQB", cchLength=0x14 | out: lpsz="HWIRORBETUPRHDGLYFQB") returned 0x14 [0107.390] CharUpperBuffW (in: lpsz="VRLUIXZLYOWWWIJQNUOQ", cchLength=0x14 | out: lpsz="VRLUIXZLYOWWWIJQNUOQ") returned 0x14 [0107.392] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xb9fdc8, lpFilePart=0xbafdcc | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0xbafdcc*="RtlUpd64.exe") returned 0x33 [0107.392] GetSysColorBrush (nIndex=15) returned 0x1100059 [0107.392] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0107.392] LoadIconW (hInstance=0x3f0000, lpIconName=0x63) returned 0x1a022f [0107.393] LoadIconW (hInstance=0x3f0000, lpIconName=0xa4) returned 0x0 [0107.393] LoadIconW (hInstance=0x3f0000, lpIconName=0xa2) returned 0x0 [0107.393] LoadImageW (hInst=0x3f0000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0xb0213 [0107.394] RegisterClassExW (param_1=0xbafda4) returned 0xc16b [0107.394] GetSysColorBrush (nIndex=15) returned 0x1100059 [0107.394] RegisterClassExW (param_1=0xbafd48) returned 0xc17e [0107.394] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc072 [0107.394] InitCommonControlsEx (picce=0xbafd78) returned 1 [0107.394] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0xc9e948 [0107.395] LoadIconW (hInstance=0x3f0000, lpIconName=0xa9) returned 0xe0237 [0107.395] ImageList_ReplaceIcon (himl=0xc9e948, i=-1, hicon=0xe0237) returned 0 [0107.396] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x3f0000, lpParam=0x0) returned 0x701ae [0107.396] DefWindowProcW (hWnd=0x701ae, Msg=0x24, wParam=0x0, lParam=0xbaf9e0) returned 0x0 [0107.397] DefWindowProcW (hWnd=0x701ae, Msg=0x81, wParam=0x0, lParam=0xbaf9c0) returned 0x1 [0107.398] DefWindowProcW (hWnd=0x701ae, Msg=0x83, wParam=0x0, lParam=0xbafa00) returned 0x0 [0107.400] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0107.400] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc072 [0107.400] CreatePopupMenu () returned 0x900fd [0107.401] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x701ae, hMenu=0x1, hInstance=0x3f0000, lpParam=0x0) returned 0x2023e [0107.408] DefWindowProcW (hWnd=0x701ae, Msg=0x210, wParam=0x10001, lParam=0x2023e) returned 0x0 [0107.408] ShowWindow (hWnd=0x701ae, nCmdShow=0) returned 0 [0107.408] ShowWindow (hWnd=0x701ae, nCmdShow=0) returned 0 [0107.408] PeekMessageW (in: lpMsg=0xbafcfc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafcfc) returned 0 [0107.409] CharUpperBuffW (in: lpsz="EYUGCPDIYNRZXLSBKUGV", cchLength=0x14 | out: lpsz="EYUGCPDIYNRZXLSBKUGV") returned 0x14 [0107.409] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.410] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.410] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.410] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.410] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.410] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.411] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.411] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.411] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.411] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.412] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.413] CharUpperBuffW (in: lpsz="UserName", cchLength=0x8 | out: lpsz="USERNAME") returned 0x8 [0107.413] GetUserNameW (in: lpBuffer=0xbaf4e8, pcbBuffer=0xbaf804 | out: lpBuffer="JPenUM", pcbBuffer=0xbaf804) returned 1 [0107.426] PeekMessageW (in: lpMsg=0xbafcfc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafcfc) returned 0 [0107.426] CharUpperBuffW (in: lpsz="VAWBPFJARYLSY_LWN__Z", cchLength=0x14 | out: lpsz="VAWBPFJARYLSY_LWN__Z") returned 0x14 [0107.426] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.426] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.427] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.428] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.429] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.429] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.429] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.429] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.429] CharUpperBuffW (in: lpsz="TempDir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0107.429] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xbaf4e8 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\") returned 0x23 [0107.429] PeekMessageW (in: lpMsg=0xbafcfc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafcfc) returned 0 [0107.429] CharUpperBuffW (in: lpsz="PFTJCVYTZWZHJNBFDSVH", cchLength=0x14 | out: lpsz="PFTJCVYTZWZHJNBFDSVH") returned 0x14 [0107.429] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.429] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.430] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.431] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.432] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.432] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.432] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.432] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.432] CharUpperBuffW (in: lpsz="SystemDir", cchLength=0x9 | out: lpsz="SYSTEMDIR") returned 0x9 [0107.432] GetSystemDirectoryW (in: lpBuffer=0xbaf4e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0107.432] PeekMessageW (in: lpMsg=0xbafcfc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafcfc) returned 0 [0107.432] CharUpperBuffW (in: lpsz="PWGBLLCVBIWPGOVCYHST", cchLength=0x14 | out: lpsz="PWGBLLCVBIWPGOVCYHST") returned 0x14 [0107.432] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.432] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.432] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.432] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.433] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.434] CharUpperBuffW (in: lpsz="SW_HIDE", cchLength=0x7 | out: lpsz="SW_HIDE") returned 0x7 [0107.434] PeekMessageW (in: lpMsg=0xbafcfc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafcfc) returned 0 [0107.434] CharUpperBuffW (in: lpsz="QBAVKKEPMGFRIDJIQFYL", cchLength=0x14 | out: lpsz="QBAVKKEPMGFRIDJIQFYL") returned 0x14 [0107.435] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.435] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.435] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.436] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.437] CharUpperBuffW (in: lpsz="ScriptFullPath", cchLength=0xe | out: lpsz="SCRIPTFULLPATH") returned 0xe [0107.438] PeekMessageW (in: lpMsg=0xbafcfc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafcfc) returned 0 [0107.438] CharUpperBuffW (in: lpsz="ZHFSEIECLKQLCIGLUFVW", cchLength=0x14 | out: lpsz="ZHFSEIECLKQLCIGLUFVW") returned 0x14 [0107.438] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.438] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.438] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.438] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.438] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.438] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.438] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.438] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.438] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.438] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.438] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.439] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.439] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.439] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.439] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.440] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.441] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.441] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.441] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.441] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.441] CharUpperBuffW (in: lpsz="ScriptDir", cchLength=0x9 | out: lpsz="SCRIPTDIR") returned 0x9 [0107.441] PeekMessageW (in: lpMsg=0xbafcfc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafcfc) returned 0 [0107.441] CharUpperBuffW (in: lpsz="ZASLDIOHJDVRTPWQRMGV", cchLength=0x14 | out: lpsz="ZASLDIOHJDVRTPWQRMGV") returned 0x14 [0107.441] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.441] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.441] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.441] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaefec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaefec) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.442] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.443] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.443] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.443] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.443] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.443] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.443] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.443] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.443] PeekMessageW (in: lpMsg=0xbaf694, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf694) returned 0 [0107.443] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0107.443] CharUpperBuffW (in: lpsz="JSKPHBPSKKETVRDBHNYU", cchLength=0x14 | out: lpsz="JSKPHBPSKKETVRDBHNYU") returned 0x14 [0107.443] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.443] CharUpperBuffW (in: lpsz="HomeDrive", cchLength=0x9 | out: lpsz="HOMEDRIVE") returned 0x9 [0107.443] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0xbaf4e8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0107.444] CharUpperBuffW (in: lpsz="M_INUGTJHWXCPAXMCTAI", cchLength=0x14 | out: lpsz="M_INUGTJHWXCPAXMCTAI") returned 0x14 [0107.444] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.444] CharUpperBuffW (in: lpsz="ComSpec", cchLength=0x7 | out: lpsz="COMSPEC") returned 0x7 [0107.444] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xbaf4e8, nSize=0x104 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0107.444] CharUpperBuffW (in: lpsz="BNSYFESKKKXMBYSQHJIQ", cchLength=0x14 | out: lpsz="BNSYFESKKKXMBYSQHJIQ") returned 0x14 [0107.444] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.445] CharUpperBuffW (in: lpsz="AutoItPID", cchLength=0x9 | out: lpsz="AUTOITPID") returned 0x9 [0107.445] GetCurrentProcessId () returned 0x15c [0107.445] CharUpperBuffW (in: lpsz="LSGCAGMKVJRPUYNSDWVN", cchLength=0x14 | out: lpsz="LSGCAGMKVJRPUYNSDWVN") returned 0x14 [0107.445] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.445] CharUpperBuffW (in: lpsz="AutoItExe", cchLength=0x9 | out: lpsz="AUTOITEXE") returned 0x9 [0107.445] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb9f4c0, nSize=0x7fff | out: lpFilename="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x33 [0107.445] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xb8f4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0107.445] CharUpperBuffW (in: lpsz="FDVIELPYQBHFBSHKWRNV", cchLength=0x14 | out: lpsz="FDVIELPYQBHFBSHKWRNV") returned 0x14 [0107.446] CharUpperBuffW (in: lpsz="AAQWRUCXYFBKMERHEDVP", cchLength=0x14 | out: lpsz="AAQWRUCXYFBKMERHEDVP") returned 0x14 [0107.446] CharUpperBuffW (in: lpsz="AppDataDir", cchLength=0xa | out: lpsz="APPDATADIR") returned 0xa [0107.446] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xbaf2c8 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0107.448] CharUpperBuffW (in: lpsz="ISJEZZKAOCFKNHTKJDQV", cchLength=0x14 | out: lpsz="ISJEZZKAOCFKNHTKJDQV") returned 0x14 [0107.448] CharUpperBuffW (in: lpsz="WinExists", cchLength=0x9 | out: lpsz="WINEXISTS") returned 0x9 [0107.448] CharUpperBuffW (in: lpsz="MUSXQUMBQMSLTQRKARJJ", cchLength=0x14 | out: lpsz="MUSXQUMBQMSLTQRKARJJ") returned 0x14 [0107.448] CharUpperBuffW (in: lpsz="StringLen", cchLength=0x9 | out: lpsz="STRINGLEN") returned 0x9 [0107.448] CharUpperBuffW (in: lpsz="NOTRRKJGTFVXPFAOQZVF", cchLength=0x14 | out: lpsz="NOTRRKJGTFVXPFAOQZVF") returned 0x14 [0107.450] CharUpperBuffW (in: lpsz="StringInStr", cchLength=0xb | out: lpsz="STRINGINSTR") returned 0xb [0107.450] CharUpperBuffW (in: lpsz="JUPVPXOMUFXFQHXUCWSH", cchLength=0x14 | out: lpsz="JUPVPXOMUFXFQHXUCWSH") returned 0x14 [0107.450] CharUpperBuffW (in: lpsz="Sleep", cchLength=0x5 | out: lpsz="SLEEP") returned 0x5 [0107.450] CharUpperBuffW (in: lpsz="PRASBOPNM_MGRQFGBQCF", cchLength=0x14 | out: lpsz="PRASBOPNM_MGRQFGBQCF") returned 0x14 [0107.451] CharUpperBuffW (in: lpsz="ShellExecute", cchLength=0xc | out: lpsz="SHELLEXECUTE") returned 0xc [0107.451] CharUpperBuffW (in: lpsz="QUUZWZOLIYMFBCZKMNKZ", cchLength=0x14 | out: lpsz="QUUZWZOLIYMFBCZKMNKZ") returned 0x14 [0107.451] CharUpperBuffW (in: lpsz="RegWrite", cchLength=0x8 | out: lpsz="REGWRITE") returned 0x8 [0107.451] CharUpperBuffW (in: lpsz="NVDECIIZNY_FJETTNKCF", cchLength=0x14 | out: lpsz="NVDECIIZNY_FJETTNKCF") returned 0x14 [0107.451] CharUpperBuffW (in: lpsz="RegRead", cchLength=0x7 | out: lpsz="REGREAD") returned 0x7 [0107.451] CharUpperBuffW (in: lpsz="JCBCSQJKBAHQJLQPHFQD", cchLength=0x14 | out: lpsz="JCBCSQJKBAHQJLQPHFQD") returned 0x14 [0107.451] CharUpperBuffW (in: lpsz="Random", cchLength=0x6 | out: lpsz="RANDOM") returned 0x6 [0107.452] CharUpperBuffW (in: lpsz="KAHBDEOIEXWXMYTRRTOX", cchLength=0x14 | out: lpsz="KAHBDEOIEXWXMYTRRTOX") returned 0x14 [0107.452] CharUpperBuffW (in: lpsz="Ptr", cchLength=0x3 | out: lpsz="PTR") returned 0x3 [0107.452] CharUpperBuffW (in: lpsz="ZHMUXYEMHNIVGJBJDMMF", cchLength=0x14 | out: lpsz="ZHMUXYEMHNIVGJBJDMMF") returned 0x14 [0107.452] CharUpperBuffW (in: lpsz="ObjGet", cchLength=0x6 | out: lpsz="OBJGET") returned 0x6 [0107.452] CharUpperBuffW (in: lpsz="VMLKPAFPAPNKNHTCBZRR", cchLength=0x14 | out: lpsz="VMLKPAFPAPNKNHTCBZRR") returned 0x14 [0107.452] CharUpperBuffW (in: lpsz="Mod", cchLength=0x3 | out: lpsz="MOD") returned 0x3 [0107.452] CharUpperBuffW (in: lpsz="REDKXUVIBQAOCPLAQHXB", cchLength=0x14 | out: lpsz="REDKXUVIBQAOCPLAQHXB") returned 0x14 [0107.452] CharUpperBuffW (in: lpsz="IsString", cchLength=0x8 | out: lpsz="ISSTRING") returned 0x8 [0107.452] CharUpperBuffW (in: lpsz="OJTKASVFTSYXKBWX_WNX", cchLength=0x14 | out: lpsz="OJTKASVFTSYXKBWX_WNX") returned 0x14 [0107.453] CharUpperBuffW (in: lpsz="IsPtr", cchLength=0x5 | out: lpsz="ISPTR") returned 0x5 [0107.453] CharUpperBuffW (in: lpsz="ZAWMLSAXDCXMHRNMO_WJ", cchLength=0x14 | out: lpsz="ZAWMLSAXDCXMHRNMO_WJ") returned 0x14 [0107.453] CharUpperBuffW (in: lpsz="IsFloat", cchLength=0x7 | out: lpsz="ISFLOAT") returned 0x7 [0107.453] CharUpperBuffW (in: lpsz="PHPGCBELK_YPOEERMNXJ", cchLength=0x14 | out: lpsz="PHPGCBELK_YPOEERMNXJ") returned 0x14 [0107.453] CharUpperBuffW (in: lpsz="IsBool", cchLength=0x6 | out: lpsz="ISBOOL") returned 0x6 [0107.454] CharUpperBuffW (in: lpsz="WOCMAOSQEUUABGNESWBM", cchLength=0x14 | out: lpsz="WOCMAOSQEUUABGNESWBM") returned 0x14 [0107.454] CharUpperBuffW (in: lpsz="IsBinary", cchLength=0x8 | out: lpsz="ISBINARY") returned 0x8 [0107.454] CharUpperBuffW (in: lpsz="KGPWKXXEFKMQLGNWECVG", cchLength=0x14 | out: lpsz="KGPWKXXEFKMQLGNWECVG") returned 0x14 [0107.454] CharUpperBuffW (in: lpsz="IsAdmin", cchLength=0x7 | out: lpsz="ISADMIN") returned 0x7 [0107.454] CharUpperBuffW (in: lpsz="MAHKEWEXGTPUVKVEGPO_", cchLength=0x14 | out: lpsz="MAHKEWEXGTPUVKVEGPO_") returned 0x14 [0107.454] CharUpperBuffW (in: lpsz="Int", cchLength=0x3 | out: lpsz="INT") returned 0x3 [0107.454] CharUpperBuffW (in: lpsz="_YWCISGXTVBDUOVXPQMI", cchLength=0x14 | out: lpsz="_YWCISGXTVBDUOVXPQMI") returned 0x14 [0107.455] CharUpperBuffW (in: lpsz="FileWrite", cchLength=0x9 | out: lpsz="FILEWRITE") returned 0x9 [0107.455] CharUpperBuffW (in: lpsz="DUZNPLRFXOELYOJWMYRZ", cchLength=0x14 | out: lpsz="DUZNPLRFXOELYOJWMYRZ") returned 0x14 [0107.455] CharUpperBuffW (in: lpsz="FileSetAttrib", cchLength=0xd | out: lpsz="FILESETATTRIB") returned 0xd [0107.455] CharUpperBuffW (in: lpsz="JXHOFWTYAAIMRXVFTQE_", cchLength=0x14 | out: lpsz="JXHOFWTYAAIMRXVFTQE_") returned 0x14 [0107.455] CharUpperBuffW (in: lpsz="FileRead", cchLength=0x8 | out: lpsz="FILEREAD") returned 0x8 [0107.455] CharUpperBuffW (in: lpsz="SACWIMSIHENVHPTUMXPE", cchLength=0x14 | out: lpsz="SACWIMSIHENVHPTUMXPE") returned 0x14 [0107.455] CharUpperBuffW (in: lpsz="FileOpen", cchLength=0x8 | out: lpsz="FILEOPEN") returned 0x8 [0107.455] CharUpperBuffW (in: lpsz="XUULJMNSYNUPYVWXSZYG", cchLength=0x14 | out: lpsz="XUULJMNSYNUPYVWXSZYG") returned 0x14 [0107.456] CharUpperBuffW (in: lpsz="FileExists", cchLength=0xa | out: lpsz="FILEEXISTS") returned 0xa [0107.460] CharUpperBuffW (in: lpsz="GSMCLNXRCRDHAXIOWENF", cchLength=0x14 | out: lpsz="GSMCLNXRCRDHAXIOWENF") returned 0x14 [0107.461] CharUpperBuffW (in: lpsz="FileDelete", cchLength=0xa | out: lpsz="FILEDELETE") returned 0xa [0107.461] CharUpperBuffW (in: lpsz="DLESKBDQQFCHDDDMIDEA", cchLength=0x14 | out: lpsz="DLESKBDQQFCHDDDMIDEA") returned 0x14 [0107.461] CharUpperBuffW (in: lpsz="FileCopy", cchLength=0x8 | out: lpsz="FILECOPY") returned 0x8 [0107.461] CharUpperBuffW (in: lpsz="XHOSXSKKYFMAUHTBFHCA", cchLength=0x14 | out: lpsz="XHOSXSKKYFMAUHTBFHCA") returned 0x14 [0107.461] CharUpperBuffW (in: lpsz="FileClose", cchLength=0x9 | out: lpsz="FILECLOSE") returned 0x9 [0107.461] CharUpperBuffW (in: lpsz="_QEYKFIAHEYCACPPUXWV", cchLength=0x14 | out: lpsz="_QEYKFIAHEYCACPPUXWV") returned 0x14 [0107.461] CharUpperBuffW (in: lpsz="Eval", cchLength=0x4 | out: lpsz="EVAL") returned 0x4 [0107.461] CharUpperBuffW (in: lpsz="M_FBUIIQDAGUAU_RACCL", cchLength=0x14 | out: lpsz="M_FBUIIQDAGUAU_RACCL") returned 0x14 [0107.476] CharUpperBuffW (in: lpsz="DriveGetDrive", cchLength=0xd | out: lpsz="DRIVEGETDRIVE") returned 0xd [0107.477] CharUpperBuffW (in: lpsz="NDCHJOSUDZTBTGVUCWDB", cchLength=0x14 | out: lpsz="NDCHJOSUDZTBTGVUCWDB") returned 0x14 [0107.477] CharUpperBuffW (in: lpsz="DllStructSetData", cchLength=0x10 | out: lpsz="DLLSTRUCTSETDATA") returned 0x10 [0107.477] CharUpperBuffW (in: lpsz="ERXPGKRYZYLSLKZDSACZ", cchLength=0x14 | out: lpsz="ERXPGKRYZYLSLKZDSACZ") returned 0x14 [0107.477] CharUpperBuffW (in: lpsz="DllStructGetSize", cchLength=0x10 | out: lpsz="DLLSTRUCTGETSIZE") returned 0x10 [0107.477] CharUpperBuffW (in: lpsz="FZMDXRSNTFQG_ZPUEHLH", cchLength=0x14 | out: lpsz="FZMDXRSNTFQG_ZPUEHLH") returned 0x14 [0107.492] CharUpperBuffW (in: lpsz="DllStructGetPtr", cchLength=0xf | out: lpsz="DLLSTRUCTGETPTR") returned 0xf [0107.492] CharUpperBuffW (in: lpsz="BRMZWPJQKKWFLEAGBXUX", cchLength=0x14 | out: lpsz="BRMZWPJQKKWFLEAGBXUX") returned 0x14 [0107.492] CharUpperBuffW (in: lpsz="DllStructGetData", cchLength=0x10 | out: lpsz="DLLSTRUCTGETDATA") returned 0x10 [0107.492] CharUpperBuffW (in: lpsz="ETDESII_JCPEKLNFZOOK", cchLength=0x14 | out: lpsz="ETDESII_JCPEKLNFZOOK") returned 0x14 [0107.492] CharUpperBuffW (in: lpsz="DllStructCreate", cchLength=0xf | out: lpsz="DLLSTRUCTCREATE") returned 0xf [0107.492] CharUpperBuffW (in: lpsz="WJNZPVCEXYQAWKKAOPXE", cchLength=0x14 | out: lpsz="WJNZPVCEXYQAWKKAOPXE") returned 0x14 [0107.494] CharUpperBuffW (in: lpsz="DllOpen", cchLength=0x7 | out: lpsz="DLLOPEN") returned 0x7 [0107.494] CharUpperBuffW (in: lpsz="RZBCABNWUPZLBALLSEYP", cchLength=0x14 | out: lpsz="RZBCABNWUPZLBALLSEYP") returned 0x14 [0107.494] CharUpperBuffW (in: lpsz="DllClose", cchLength=0x8 | out: lpsz="DLLCLOSE") returned 0x8 [0107.494] CharUpperBuffW (in: lpsz="ZU_OYEQNTWHCWPJPGJNX", cchLength=0x14 | out: lpsz="ZU_OYEQNTWHCWPJPGJNX") returned 0x14 [0107.494] CharUpperBuffW (in: lpsz="DllCallAddress", cchLength=0xe | out: lpsz="DLLCALLADDRESS") returned 0xe [0107.494] CharUpperBuffW (in: lpsz="GFJLYFLSIGQNQEMTCMBN", cchLength=0x14 | out: lpsz="GFJLYFLSIGQNQEMTCMBN") returned 0x14 [0107.494] CharUpperBuffW (in: lpsz="DllCall", cchLength=0x7 | out: lpsz="DLLCALL") returned 0x7 [0107.494] CharUpperBuffW (in: lpsz="ADRCTQTHUSOPR_NYNBYS", cchLength=0x14 | out: lpsz="ADRCTQTHUSOPR_NYNBYS") returned 0x14 [0107.495] CharUpperBuffW (in: lpsz="DirCreate", cchLength=0x9 | out: lpsz="DIRCREATE") returned 0x9 [0107.495] CharUpperBuffW (in: lpsz="XYVOCQGEPGTRBENKHFBB", cchLength=0x14 | out: lpsz="XYVOCQGEPGTRBENKHFBB") returned 0x14 [0107.495] CharUpperBuffW (in: lpsz="BinaryMid", cchLength=0x9 | out: lpsz="BINARYMID") returned 0x9 [0107.495] CharUpperBuffW (in: lpsz="NKYYMWXNOLVPNJOWSPHU", cchLength=0x14 | out: lpsz="NKYYMWXNOLVPNJOWSPHU") returned 0x14 [0107.495] CharUpperBuffW (in: lpsz="BinaryLen", cchLength=0x9 | out: lpsz="BINARYLEN") returned 0x9 [0107.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbaf760 | out: lpSystemTimeAsFileTime=0xbaf760*(dwLowDateTime=0x2d1de890, dwHighDateTime=0x1d4b1a5)) [0107.496] CharUpperBuffW (in: lpsz="NZPZJNK_OOFQCFTPSFQU", cchLength=0x14 | out: lpsz="NZPZJNK_OOFQCFTPSFQU") returned 0x14 [0107.497] CharUpperBuffW (in: lpsz="ANTIEMULATION", cchLength=0xd | out: lpsz="ANTIEMULATION") returned 0xd [0107.498] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.498] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.498] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.498] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.498] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.499] CharUpperBuffW (in: lpsz="VPMTSGRTYAWJBNTCAFQV", cchLength=0x14 | out: lpsz="VPMTSGRTYAWJBNTCAFQV") returned 0x14 [0107.499] CharUpperBuffW (in: lpsz="RTVNJRJDKSCKHKDVEEKZ", cchLength=0x14 | out: lpsz="RTVNJRJDKSCKHKDVEEKZ") returned 0x14 [0107.499] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.499] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.499] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.499] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.499] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.500] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.500] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.500] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.500] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.501] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.501] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.501] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.501] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.501] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.501] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.501] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.502] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.502] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.502] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.502] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.502] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.502] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.502] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.502] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.503] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.503] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.503] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.503] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.503] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.503] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.503] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.504] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.504] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.504] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.504] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.504] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.504] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.504] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.505] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.505] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.505] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.505] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.505] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.505] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.505] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.505] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.506] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.506] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.506] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.506] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.506] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.506] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.506] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.507] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.507] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.507] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.507] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.507] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.507] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.508] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.508] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.508] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.508] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.508] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.508] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.508] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.509] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.509] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.509] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.509] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.509] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.510] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.510] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.510] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.510] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.510] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.510] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.510] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.510] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.511] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.511] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.511] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.511] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.511] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.511] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.511] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.512] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.512] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.512] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.512] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.512] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.512] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.512] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.513] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.513] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.513] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.513] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.513] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.513] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.513] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.513] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.514] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.514] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.514] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.514] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.515] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.515] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.515] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.515] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.515] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.515] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.515] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.515] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.516] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.516] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.516] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.516] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.516] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.516] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.516] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.517] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.517] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.517] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.517] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.517] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.517] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.517] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.518] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.518] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.518] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.518] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.518] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.518] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.518] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.518] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.519] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.519] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.519] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.519] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.519] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.519] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.519] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.519] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.520] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.520] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.520] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.520] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.520] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.520] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.520] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.521] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.521] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.521] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.521] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.521] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.521] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.521] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.522] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.522] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.522] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.522] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.522] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.522] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.522] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.522] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.523] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.523] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.523] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.523] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.524] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.524] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.524] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.524] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.524] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.524] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.524] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.525] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.525] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.525] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.525] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.525] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.525] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.525] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.526] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.526] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.526] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.526] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.526] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.526] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.526] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.527] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.527] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.527] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.527] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.527] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.527] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.527] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.527] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.528] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.528] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.528] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.528] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.528] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.528] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.529] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.529] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.529] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.529] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.529] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.529] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.529] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.530] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.530] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.530] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.530] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.530] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0107.530] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0107.530] CharUpperBuffW (in: lpsz="EMQYZNXESVTIFBMIJRTU", cchLength=0x14 | out: lpsz="EMQYZNXESVTIFBMIJRTU") returned 0x14 [0107.530] CharUpperBuffW (in: lpsz="_OMFPKLKLPSRWLIGGGHY", cchLength=0x14 | out: lpsz="_OMFPKLKLPSRWLIGGGHY") returned 0x14 [0107.531] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.796] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb9f2d8, nSize=0x7fff | out: lpFilename="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x33 [0107.796] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xb8f2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0107.797] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe:Zone.Identifier", nBufferLength=0x7fff, lpBuffer=0xb9f508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe:Zone.Identifier", lpFilePart=0x0) returned 0x43 [0107.797] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe:Zone.Identifier" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe:zone.identifier")) returned 0xffffffff [0107.797] FindFirstFileW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe:Zone.Identifier", lpFindFileData=0xbaf550 | out: lpFindFileData=0xbaf550) returned 0xffffffff [0107.797] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.799] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0107.799] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateMutexW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0107.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateMutexW", cchWideChar=13, lpMultiByteStr=0x10244c8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateMutexW", lpUsedDefaultChar=0x0) returned 13 [0107.800] GetProcAddress (hModule=0x777b0000, lpProcName="CreateMutexW") returned 0x777f2aee [0107.800] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="AuditNativeSnapIn") returned 0x120 [0107.801] FreeLibrary (hLibModule=0x777b0000) returned 1 [0107.801] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0107.801] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetLastError", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0107.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetLastError", cchWideChar=13, lpMultiByteStr=0x1023e38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetLastError", lpUsedDefaultChar=0x0) returned 13 [0107.801] GetProcAddress (hModule=0x777b0000, lpProcName="GetLastError") returned 0x777fbf00 [0107.802] FreeLibrary (hLibModule=0x777b0000) returned 1 [0107.803] EnumWindows (lpEnumFunc=0x44b196, lParam=0x4b5500) returned 1 [0107.803] GetWindowTextW (in: hWnd=0x10066, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.803] GetClassNameW (in: hWnd=0x10066, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.804] GetWindowTextW (in: hWnd=0x10064, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.804] GetClassNameW (in: hWnd=0x10064, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.804] GetWindowTextW (in: hWnd=0x10050, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.804] GetClassNameW (in: hWnd=0x10050, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.804] GetWindowTextW (in: hWnd=0x10078, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.804] GetClassNameW (in: hWnd=0x10078, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.804] GetWindowTextW (in: hWnd=0x1006e, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.804] GetClassNameW (in: hWnd=0x1006e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.804] GetWindowTextW (in: hWnd=0x1006c, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.804] GetClassNameW (in: hWnd=0x1006c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.804] GetWindowTextW (in: hWnd=0x10068, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.804] GetClassNameW (in: hWnd=0x10068, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.804] GetWindowTextW (in: hWnd=0x10048, lpString=0xbae880, nMaxCount=1024 | out: lpString="Start") returned 5 [0107.804] GetClassNameW (in: hWnd=0x10048, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0107.804] GetWindowTextW (in: hWnd=0x2001e, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.804] GetClassNameW (in: hWnd=0x2001e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0107.804] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0107.804] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0107.805] GetWindowTextW (in: hWnd=0x10114, lpString=0xbae880, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0107.805] GetClassNameW (in: hWnd=0x10114, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0107.805] GetWindowTextW (in: hWnd=0x100da, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x100da, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.805] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.805] GetWindowTextW (in: hWnd=0x100bc, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x100bc, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.805] GetWindowTextW (in: hWnd=0x10094, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x10094, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.805] GetWindowTextW (in: hWnd=0x50082, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x50082, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.805] GetWindowTextW (in: hWnd=0x1007a, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x1007a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0107.805] GetWindowTextW (in: hWnd=0x1008c, lpString=0xbae880, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0107.805] GetClassNameW (in: hWnd=0x1008c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0107.805] GetWindowTextW (in: hWnd=0x2022c, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x2022c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.805] GetWindowTextW (in: hWnd=0x301b8, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x301b8, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.805] GetWindowTextW (in: hWnd=0x3019a, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x3019a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.805] GetWindowTextW (in: hWnd=0x20228, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x20228, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.805] GetWindowTextW (in: hWnd=0x20238, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.805] GetClassNameW (in: hWnd=0x20238, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.805] GetWindowTextW (in: hWnd=0x20234, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x20234, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x20220, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x20220, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x2025c, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x2025c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x20266, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x20266, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x20268, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x20268, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x20246, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x20246, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x20254, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x20254, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x20250, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x2024a, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x2024a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x2024c, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x2024c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x2021e, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x2021e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x2020e, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x2020e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x20216, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.806] GetClassNameW (in: hWnd=0x20216, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.806] GetWindowTextW (in: hWnd=0x201f6, lpString=0xbae880, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0107.806] GetClassNameW (in: hWnd=0x201f6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0107.807] GetWindowTextW (in: hWnd=0x701ae, lpString=0xbae880, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0107.807] DefWindowProcW (hWnd=0x701ae, Msg=0xd, wParam=0x400, lParam=0xbae880) returned 0x9 [0107.807] GetClassNameW (in: hWnd=0x701ae, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0107.807] GetWindowTextW (in: hWnd=0x300e6, lpString=0xbae880, nMaxCount=1024 | out: lpString="TaskEng - Task Scheduler Engine Process") returned 39 [0107.807] GetClassNameW (in: hWnd=0x300e6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0107.807] GetWindowTextW (in: hWnd=0x30282, lpString=0xbae880, nMaxCount=1024 | out: lpString=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0107.807] GetClassNameW (in: hWnd=0x30282, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0107.807] GetWindowTextW (in: hWnd=0x20286, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.807] GetClassNameW (in: hWnd=0x20286, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.807] GetWindowTextW (in: hWnd=0x30130, lpString=0xbae880, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0107.807] GetClassNameW (in: hWnd=0x30130, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0107.807] GetWindowTextW (in: hWnd=0x20198, lpString=0xbae880, nMaxCount=1024 | out: lpString="Oil") returned 3 [0107.807] GetClassNameW (in: hWnd=0x20198, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0107.807] GetWindowTextW (in: hWnd=0x20178, lpString=0xbae880, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0107.807] GetClassNameW (in: hWnd=0x20178, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0107.807] GetWindowTextW (in: hWnd=0x20176, lpString=0xbae880, nMaxCount=1024 | out: lpString="Runner") returned 6 [0107.807] GetClassNameW (in: hWnd=0x20176, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0107.807] GetWindowTextW (in: hWnd=0x2016e, lpString=0xbae880, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0107.807] GetClassNameW (in: hWnd=0x2016e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0107.807] GetWindowTextW (in: hWnd=0x2016a, lpString=0xbae880, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0107.807] GetClassNameW (in: hWnd=0x2016a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0107.807] GetWindowTextW (in: hWnd=0x3019e, lpString=0xbae880, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0107.807] GetClassNameW (in: hWnd=0x3019e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0107.807] GetWindowTextW (in: hWnd=0x30188, lpString=0xbae880, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0107.807] GetClassNameW (in: hWnd=0x30188, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0107.807] GetWindowTextW (in: hWnd=0x20164, lpString=0xbae880, nMaxCount=1024 | out: lpString="Charging") returned 8 [0107.807] GetClassNameW (in: hWnd=0x20164, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0107.808] GetWindowTextW (in: hWnd=0x20160, lpString=0xbae880, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0107.808] GetClassNameW (in: hWnd=0x20160, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0107.808] GetWindowTextW (in: hWnd=0x2015c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0107.808] GetClassNameW (in: hWnd=0x2015c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0107.808] GetWindowTextW (in: hWnd=0x20158, lpString=0xbae880, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0107.808] GetClassNameW (in: hWnd=0x20158, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0107.808] GetWindowTextW (in: hWnd=0x40152, lpString=0xbae880, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0107.808] GetClassNameW (in: hWnd=0x40152, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0107.808] GetWindowTextW (in: hWnd=0xd013a, lpString=0xbae880, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0107.808] GetClassNameW (in: hWnd=0xd013a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0107.808] GetWindowTextW (in: hWnd=0x301bc, lpString=0xbae880, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0107.808] GetClassNameW (in: hWnd=0x301bc, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0107.808] GetWindowTextW (in: hWnd=0x300dc, lpString=0xbae880, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0107.808] GetClassNameW (in: hWnd=0x300dc, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0107.808] GetWindowTextW (in: hWnd=0x30174, lpString=0xbae880, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0107.808] GetClassNameW (in: hWnd=0x30174, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0107.808] GetWindowTextW (in: hWnd=0x20148, lpString=0xbae880, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0107.808] GetClassNameW (in: hWnd=0x20148, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0107.808] GetWindowTextW (in: hWnd=0x20142, lpString=0xbae880, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0107.808] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0107.808] GetWindowTextW (in: hWnd=0x30144, lpString=0xbae880, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0107.808] GetClassNameW (in: hWnd=0x30144, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0107.808] GetWindowTextW (in: hWnd=0x901b0, lpString=0xbae880, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0107.808] GetClassNameW (in: hWnd=0x901b0, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0107.808] GetWindowTextW (in: hWnd=0x501a4, lpString=0xbae880, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0107.808] GetClassNameW (in: hWnd=0x501a4, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0107.809] GetWindowTextW (in: hWnd=0x201a8, lpString=0xbae880, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0107.809] GetClassNameW (in: hWnd=0x201a8, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0107.809] GetWindowTextW (in: hWnd=0x2014e, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.809] GetClassNameW (in: hWnd=0x2014e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0107.809] GetWindowTextW (in: hWnd=0x101be, lpString=0xbae880, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0107.809] GetClassNameW (in: hWnd=0x101be, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0107.809] GetWindowTextW (in: hWnd=0x4013c, lpString=0xbae880, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0107.809] GetClassNameW (in: hWnd=0x4013c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0107.809] GetWindowTextW (in: hWnd=0x10128, lpString=0xbae880, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0107.809] GetClassNameW (in: hWnd=0x10128, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0107.809] GetWindowTextW (in: hWnd=0x20126, lpString=0xbae880, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0107.809] GetClassNameW (in: hWnd=0x20126, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0107.809] GetWindowTextW (in: hWnd=0x2011a, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.809] GetClassNameW (in: hWnd=0x2011a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0107.809] GetWindowTextW (in: hWnd=0x1010a, lpString=0xbae880, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0107.809] GetClassNameW (in: hWnd=0x1010a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0107.809] GetWindowTextW (in: hWnd=0x10102, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.809] GetClassNameW (in: hWnd=0x10102, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0107.809] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbae880, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0107.809] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0107.809] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.809] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.809] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.809] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.809] GetWindowTextW (in: hWnd=0x20034, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.809] GetClassNameW (in: hWnd=0x20034, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.809] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.809] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.810] GetWindowTextW (in: hWnd=0x100c2, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x100c2, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0107.810] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0107.810] GetWindowTextW (in: hWnd=0x100ac, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x100ac, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.810] GetWindowTextW (in: hWnd=0x100a6, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x100a6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.810] GetWindowTextW (in: hWnd=0x200a0, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x200a0, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.810] GetWindowTextW (in: hWnd=0x10086, lpString=0xbae880, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0107.810] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0107.810] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0107.810] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0107.810] GetWindowTextW (in: hWnd=0x40024, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x40024, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.810] GetWindowTextW (in: hWnd=0x10072, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x10072, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.810] GetWindowTextW (in: hWnd=0x1006a, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x1006a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.810] GetWindowTextW (in: hWnd=0x10058, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x10058, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.810] GetWindowTextW (in: hWnd=0x100e2, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x100e2, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.810] GetWindowTextW (in: hWnd=0x10054, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.810] GetClassNameW (in: hWnd=0x10054, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0107.810] GetWindowTextW (in: hWnd=0x2001a, lpString=0xbae880, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0107.810] GetClassNameW (in: hWnd=0x2001a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0107.811] GetWindowTextW (in: hWnd=0x30028, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.811] GetClassNameW (in: hWnd=0x30028, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0107.811] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.811] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0107.811] GetWindowTextW (in: hWnd=0x1003a, lpString=0xbae880, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0107.811] GetClassNameW (in: hWnd=0x1003a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0107.811] GetWindowTextW (in: hWnd=0x1002e, lpString=0xbae880, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0107.811] GetClassNameW (in: hWnd=0x1002e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0107.811] GetWindowTextW (in: hWnd=0x10036, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.811] GetClassNameW (in: hWnd=0x10036, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0107.811] GetWindowTextW (in: hWnd=0x30026, lpString=0xbae880, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0107.811] GetClassNameW (in: hWnd=0x30026, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0107.811] GetWindowTextW (in: hWnd=0x100d0, lpString=0xbae880, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0107.811] GetClassNameW (in: hWnd=0x100d0, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0107.811] GetWindowTextW (in: hWnd=0x20020, lpString=0xbae880, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0107.811] GetClassNameW (in: hWnd=0x20020, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0107.811] GetWindowTextW (in: hWnd=0x20022, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.811] GetClassNameW (in: hWnd=0x20022, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.811] GetWindowTextW (in: hWnd=0x10116, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.811] GetClassNameW (in: hWnd=0x10116, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.811] GetWindowTextW (in: hWnd=0x2022e, lpString=0xbae880, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0107.811] GetClassNameW (in: hWnd=0x2022e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0107.811] GetWindowTextW (in: hWnd=0x301f8, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.811] GetClassNameW (in: hWnd=0x301f8, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.811] GetWindowTextW (in: hWnd=0x20242, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.811] GetClassNameW (in: hWnd=0x20242, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.811] GetWindowTextW (in: hWnd=0x40204, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.811] GetClassNameW (in: hWnd=0x40204, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x20278, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x20278, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x30200, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x30200, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x201d2, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x201d2, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x20182, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x20182, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x20180, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x20180, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x20170, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x20170, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x2016c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x2016c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x20168, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x20168, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x3019c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x3019c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x20166, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x20166, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x20162, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x20162, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x2015e, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x2015e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x2015a, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x2015a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.812] GetWindowTextW (in: hWnd=0x20156, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.812] GetClassNameW (in: hWnd=0x20156, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x40150, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x40150, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x201ba, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x201ba, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x20172, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x20172, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x4010e, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x4010e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x2014a, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x2014a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x20146, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x20146, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x30140, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x30140, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x20154, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x20154, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x101c0, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x101c0, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x1010c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x1010c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x10104, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x1003c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x1003c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.813] GetWindowTextW (in: hWnd=0x10030, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.813] GetClassNameW (in: hWnd=0x10030, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.814] GetWindowTextW (in: hWnd=0x10038, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.814] GetClassNameW (in: hWnd=0x10038, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.814] GetWindowTextW (in: hWnd=0x100ec, lpString=0xbae880, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0107.814] GetClassNameW (in: hWnd=0x100ec, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0107.814] GetWindowTextW (in: hWnd=0x2002a, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.814] GetClassNameW (in: hWnd=0x2002a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.814] CharUpperBuffW (in: lpsz="HAMOKBAMRNQLQWNMQBAB", cchLength=0x14 | out: lpsz="HAMOKBAMRNQLQWNMQBAB") returned 0x14 [0107.814] EnumWindows (lpEnumFunc=0x44b196, lParam=0x4b5500) [0107.814] GetWindowTextW (in: hWnd=0x10066, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.814] GetClassNameW (in: hWnd=0x10066, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.815] GetWindowTextW (in: hWnd=0x10064, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x10064, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.815] GetWindowTextW (in: hWnd=0x10050, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x10050, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.815] GetWindowTextW (in: hWnd=0x10078, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x10078, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.815] GetWindowTextW (in: hWnd=0x1006e, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x1006e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.815] GetWindowTextW (in: hWnd=0x1006c, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x1006c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.815] GetWindowTextW (in: hWnd=0x10068, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x10068, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.815] GetWindowTextW (in: hWnd=0x10048, lpString=0xbae880, nMaxCount=1024 | out: lpString="Start") returned 5 [0107.815] GetClassNameW (in: hWnd=0x10048, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0107.815] GetWindowTextW (in: hWnd=0x2001e, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x2001e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0107.815] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0107.815] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0107.815] GetWindowTextW (in: hWnd=0x10114, lpString=0xbae880, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0107.815] GetClassNameW (in: hWnd=0x10114, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0107.815] GetWindowTextW (in: hWnd=0x100da, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x100da, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.815] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.815] GetWindowTextW (in: hWnd=0x100bc, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x100bc, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.815] GetWindowTextW (in: hWnd=0x10094, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.815] GetClassNameW (in: hWnd=0x10094, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x50082, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x50082, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x1007a, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x1007a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0107.816] GetWindowTextW (in: hWnd=0x1008c, lpString=0xbae880, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0107.816] GetClassNameW (in: hWnd=0x1008c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0107.816] GetWindowTextW (in: hWnd=0x2022c, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x2022c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x301b8, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x301b8, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x3019a, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x3019a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x20228, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x20228, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x20238, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x20238, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x20234, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x20234, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x20220, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x20220, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x2025c, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x2025c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x20266, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x20266, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x20268, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x20268, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.816] GetWindowTextW (in: hWnd=0x20246, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.816] GetClassNameW (in: hWnd=0x20246, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.817] GetWindowTextW (in: hWnd=0x20254, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.817] GetClassNameW (in: hWnd=0x20254, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.817] GetWindowTextW (in: hWnd=0x20250, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.817] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.817] GetWindowTextW (in: hWnd=0x2024a, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.817] GetClassNameW (in: hWnd=0x2024a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.817] GetWindowTextW (in: hWnd=0x2024c, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.817] GetClassNameW (in: hWnd=0x2024c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.817] GetWindowTextW (in: hWnd=0x2021e, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.817] GetClassNameW (in: hWnd=0x2021e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.817] GetWindowTextW (in: hWnd=0x2020e, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.817] GetClassNameW (in: hWnd=0x2020e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.817] GetWindowTextW (in: hWnd=0x20216, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.817] GetClassNameW (in: hWnd=0x20216, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.817] GetWindowTextW (in: hWnd=0x201f6, lpString=0xbae880, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0107.817] GetClassNameW (in: hWnd=0x201f6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0107.817] GetWindowTextW (in: hWnd=0x701ae, lpString=0xbae880, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0107.817] DefWindowProcW (hWnd=0x701ae, Msg=0xd, wParam=0x400, lParam=0xbae880) returned 0x9 [0107.817] GetClassNameW (in: hWnd=0x701ae, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0107.817] GetWindowTextW (in: hWnd=0x300e6, lpString=0xbae880, nMaxCount=1024 | out: lpString="TaskEng - Task Scheduler Engine Process") returned 39 [0107.817] GetClassNameW (in: hWnd=0x300e6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0107.817] GetWindowTextW (in: hWnd=0x30282, lpString=0xbae880, nMaxCount=1024 | out: lpString=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0107.817] GetClassNameW (in: hWnd=0x30282, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0107.817] GetWindowTextW (in: hWnd=0x20286, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.817] GetClassNameW (in: hWnd=0x20286, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.817] GetWindowTextW (in: hWnd=0x30130, lpString=0xbae880, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0107.817] GetClassNameW (in: hWnd=0x30130, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0107.817] GetWindowTextW (in: hWnd=0x20198, lpString=0xbae880, nMaxCount=1024 | out: lpString="Oil") returned 3 [0107.818] GetClassNameW (in: hWnd=0x20198, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0107.818] GetWindowTextW (in: hWnd=0x20178, lpString=0xbae880, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0107.818] GetClassNameW (in: hWnd=0x20178, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0107.818] GetWindowTextW (in: hWnd=0x20176, lpString=0xbae880, nMaxCount=1024 | out: lpString="Runner") returned 6 [0107.818] GetClassNameW (in: hWnd=0x20176, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0107.818] GetWindowTextW (in: hWnd=0x2016e, lpString=0xbae880, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0107.818] GetClassNameW (in: hWnd=0x2016e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0107.818] GetWindowTextW (in: hWnd=0x2016a, lpString=0xbae880, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0107.818] GetClassNameW (in: hWnd=0x2016a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0107.818] GetWindowTextW (in: hWnd=0x3019e, lpString=0xbae880, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0107.818] GetClassNameW (in: hWnd=0x3019e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0107.818] GetWindowTextW (in: hWnd=0x30188, lpString=0xbae880, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0107.818] GetClassNameW (in: hWnd=0x30188, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0107.818] GetWindowTextW (in: hWnd=0x20164, lpString=0xbae880, nMaxCount=1024 | out: lpString="Charging") returned 8 [0107.818] GetClassNameW (in: hWnd=0x20164, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0107.818] GetWindowTextW (in: hWnd=0x20160, lpString=0xbae880, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0107.818] GetClassNameW (in: hWnd=0x20160, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0107.818] GetWindowTextW (in: hWnd=0x2015c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0107.818] GetClassNameW (in: hWnd=0x2015c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0107.818] GetWindowTextW (in: hWnd=0x20158, lpString=0xbae880, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0107.818] GetClassNameW (in: hWnd=0x20158, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0107.818] GetWindowTextW (in: hWnd=0x40152, lpString=0xbae880, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0107.818] GetClassNameW (in: hWnd=0x40152, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0107.818] GetWindowTextW (in: hWnd=0xd013a, lpString=0xbae880, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0107.818] GetClassNameW (in: hWnd=0xd013a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0107.818] GetWindowTextW (in: hWnd=0x301bc, lpString=0xbae880, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0107.818] GetClassNameW (in: hWnd=0x301bc, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0107.818] GetWindowTextW (in: hWnd=0x300dc, lpString=0xbae880, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0107.819] GetClassNameW (in: hWnd=0x300dc, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0107.819] GetWindowTextW (in: hWnd=0x30174, lpString=0xbae880, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0107.819] GetClassNameW (in: hWnd=0x30174, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0107.819] GetWindowTextW (in: hWnd=0x20148, lpString=0xbae880, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0107.819] GetClassNameW (in: hWnd=0x20148, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0107.819] GetWindowTextW (in: hWnd=0x20142, lpString=0xbae880, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0107.819] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0107.819] GetWindowTextW (in: hWnd=0x30144, lpString=0xbae880, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0107.819] GetClassNameW (in: hWnd=0x30144, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0107.819] GetWindowTextW (in: hWnd=0x901b0, lpString=0xbae880, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0107.819] GetClassNameW (in: hWnd=0x901b0, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0107.819] GetWindowTextW (in: hWnd=0x501a4, lpString=0xbae880, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0107.819] GetClassNameW (in: hWnd=0x501a4, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0107.819] GetWindowTextW (in: hWnd=0x201a8, lpString=0xbae880, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0107.819] GetClassNameW (in: hWnd=0x201a8, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0107.819] GetWindowTextW (in: hWnd=0x2014e, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.819] GetClassNameW (in: hWnd=0x2014e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0107.819] GetWindowTextW (in: hWnd=0x101be, lpString=0xbae880, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0107.819] GetClassNameW (in: hWnd=0x101be, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0107.819] GetWindowTextW (in: hWnd=0x4013c, lpString=0xbae880, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0107.819] GetClassNameW (in: hWnd=0x4013c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0107.819] GetWindowTextW (in: hWnd=0x10128, lpString=0xbae880, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0107.819] GetClassNameW (in: hWnd=0x10128, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0107.819] GetWindowTextW (in: hWnd=0x20126, lpString=0xbae880, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0107.819] GetClassNameW (in: hWnd=0x20126, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0107.820] GetWindowTextW (in: hWnd=0x2011a, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x2011a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0107.820] GetWindowTextW (in: hWnd=0x1010a, lpString=0xbae880, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0107.820] GetClassNameW (in: hWnd=0x1010a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0107.820] GetWindowTextW (in: hWnd=0x10102, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x10102, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0107.820] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbae880, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0107.820] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0107.820] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.820] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.820] GetWindowTextW (in: hWnd=0x20034, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x20034, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.820] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.820] GetWindowTextW (in: hWnd=0x100c2, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x100c2, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0107.820] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0107.820] GetWindowTextW (in: hWnd=0x100ac, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x100ac, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.820] GetWindowTextW (in: hWnd=0x100a6, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x100a6, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.820] GetWindowTextW (in: hWnd=0x200a0, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.820] GetClassNameW (in: hWnd=0x200a0, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.820] GetWindowTextW (in: hWnd=0x10086, lpString=0xbae880, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0107.820] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0107.821] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0107.821] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0107.821] GetWindowTextW (in: hWnd=0x40024, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.821] GetClassNameW (in: hWnd=0x40024, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.821] GetWindowTextW (in: hWnd=0x10072, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.821] GetClassNameW (in: hWnd=0x10072, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.821] GetWindowTextW (in: hWnd=0x1006a, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.821] GetClassNameW (in: hWnd=0x1006a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.821] GetWindowTextW (in: hWnd=0x10058, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.821] GetClassNameW (in: hWnd=0x10058, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0107.821] GetWindowTextW (in: hWnd=0x100e2, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.821] GetClassNameW (in: hWnd=0x100e2, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0107.821] GetWindowTextW (in: hWnd=0x10054, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.821] GetClassNameW (in: hWnd=0x10054, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0107.821] GetWindowTextW (in: hWnd=0x2001a, lpString=0xbae880, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0107.821] GetClassNameW (in: hWnd=0x2001a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0107.821] GetWindowTextW (in: hWnd=0x30028, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.821] GetClassNameW (in: hWnd=0x30028, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0107.821] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.821] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0107.821] GetWindowTextW (in: hWnd=0x1003a, lpString=0xbae880, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0107.821] GetClassNameW (in: hWnd=0x1003a, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0107.821] GetWindowTextW (in: hWnd=0x1002e, lpString=0xbae880, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0107.821] GetClassNameW (in: hWnd=0x1002e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0107.821] GetWindowTextW (in: hWnd=0x10036, lpString=0xbae880, nMaxCount=1024 | out: lpString="") returned 0 [0107.821] GetClassNameW (in: hWnd=0x10036, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0107.821] GetWindowTextW (in: hWnd=0x30026, lpString=0xbae880, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0107.821] GetClassNameW (in: hWnd=0x30026, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x100d0, lpString=0xbae880, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0107.822] GetClassNameW (in: hWnd=0x100d0, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0107.822] GetWindowTextW (in: hWnd=0x20020, lpString=0xbae880, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0107.822] GetClassNameW (in: hWnd=0x20020, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0107.822] GetWindowTextW (in: hWnd=0x20022, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x20022, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x10116, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x10116, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x2022e, lpString=0xbae880, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0107.822] GetClassNameW (in: hWnd=0x2022e, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0107.822] GetWindowTextW (in: hWnd=0x301f8, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x301f8, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x20242, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x20242, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x40204, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x40204, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x20278, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x20278, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x30200, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x30200, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x201d2, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x201d2, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x20182, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x20182, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x20180, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x20180, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.822] GetWindowTextW (in: hWnd=0x20170, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.822] GetClassNameW (in: hWnd=0x20170, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.823] GetWindowTextW (in: hWnd=0x2016c, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.823] GetClassNameW (in: hWnd=0x2016c, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.823] GetWindowTextW (in: hWnd=0x20168, lpString=0xbae880, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0107.823] GetClassNameW (in: hWnd=0x20168, lpClassName=0xbae880, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0107.823] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0107.823] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.823] CharUpperBuffW (in: lpsz="JISHSAQNRFCRNIRYGBOZ", cchLength=0x14 | out: lpsz="JISHSAQNRFCRNIRYGBOZ") returned 0x14 [0107.824] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.824] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0107.824] CharUpperBuffW (in: lpsz="JHEUBZNWULMCVYSZIWHO", cchLength=0x14 | out: lpsz="JHEUBZNWULMCVYSZIWHO") returned 0x14 [0107.824] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0107.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x1024048, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceW", lpUsedDefaultChar=0x0) returned 14 [0107.824] GetProcAddress (hModule=0x777b0000, lpProcName="FindResourceW") returned 0x777f3e61 [0107.825] FindResourceW (hModule=0x0, lpName="WFS1", lpType=0xa) returned 0x4b74d8 [0107.825] FreeLibrary (hLibModule=0x777b0000) returned 1 [0107.825] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0107.825] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0107.825] CharUpperBuffW (in: lpsz="LZXDYKDLWYEUUZHLDWMY", cchLength=0x14 | out: lpsz="LZXDYKDLWYEUUZHLDWMY") returned 0x14 [0107.825] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.825] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.826] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0107.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x10242e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SizeofResource", lpUsedDefaultChar=0x0) returned 15 [0107.826] GetProcAddress (hModule=0x777b0000, lpProcName="SizeofResource") returned 0x777f3e7f [0107.826] SizeofResource (hModule=0x0, hResInfo=0x4b74d8) returned 0x50611 [0107.826] FreeLibrary (hLibModule=0x777b0000) returned 1 [0107.826] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0107.826] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.827] CharUpperBuffW (in: lpsz="DCSTEJJRTZWI_QDXAZHL", cchLength=0x14 | out: lpsz="DCSTEJJRTZWI_QDXAZHL") returned 0x14 [0107.827] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.827] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.827] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0107.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x1023ec8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoadResource", lpUsedDefaultChar=0x0) returned 13 [0107.827] GetProcAddress (hModule=0x777b0000, lpProcName="LoadResource") returned 0x777f984d [0107.828] LoadResource (hModule=0x0, hResInfo=0x4b74d8) returned 0x6651bc [0107.828] FreeLibrary (hLibModule=0x777b0000) returned 1 [0107.828] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0107.828] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.828] CharUpperBuffW (in: lpsz="KAMA_G_MVOPZHGX_NHVN", cchLength=0x14 | out: lpsz="KAMA_G_MVOPZHGX_NHVN") returned 0x14 [0107.828] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.828] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0107.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x1024360, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LockResource", lpUsedDefaultChar=0x0) returned 13 [0107.829] GetProcAddress (hModule=0x777b0000, lpProcName="LockResource") returned 0x777efd29 [0107.829] LockResource (hResData=0x6651bc) returned 0x6651bc [0107.829] FreeLibrary (hLibModule=0x777b0000) returned 1 [0107.829] CharUpperBuffW (in: lpsz="IQOZHBYWTDLIHUPBFBUV", cchLength=0x14 | out: lpsz="IQOZHBYWTDLIHUPBFBUV") returned 0x14 [0107.829] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0107.829] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0107.844] CharUpperBuffW (in: lpsz="LAJPUUBTAUPYKYTXN", cchLength=0x11 | out: lpsz="LAJPUUBTAUPYKYTXN") returned 0x11 [0107.844] CharUpperBuffW (in: lpsz="TMSKQOPVNSFXQQUYIFSK", cchLength=0x14 | out: lpsz="TMSKQOPVNSFXQQUYIFSK") returned 0x14 [0107.844] CharUpperBuffW (in: lpsz="YUXQUJTAPNSAJSQQGRCF", cchLength=0x14 | out: lpsz="YUXQUJTAPNSAJSQQGRCF") returned 0x14 [0107.845] CharUpperBuffW (in: lpsz="ZYQMYIHPZIAQJHXMDIAJ", cchLength=0x14 | out: lpsz="ZYQMYIHPZIAQJHXMDIAJ") returned 0x14 [0107.845] CharUpperBuffW (in: lpsz="ANGILWRLDVDE_PXWBSEL", cchLength=0x14 | out: lpsz="ANGILWRLDVDE_PXWBSEL") returned 0x14 [0107.845] CharUpperBuffW (in: lpsz="CRQEQZZLGAEPYQKCYUVH", cchLength=0x14 | out: lpsz="CRQEQZZLGAEPYQKCYUVH") returned 0x14 [0107.846] CharUpperBuffW (in: lpsz="HAMOKBAMRNQLQWNMQBAB", cchLength=0x14 | out: lpsz="HAMOKBAMRNQLQWNMQBAB") returned 0x14 [0107.846] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0107.846] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.846] CharUpperBuffW (in: lpsz="JISHSAQNRFCRNIRYGBOZ", cchLength=0x14 | out: lpsz="JISHSAQNRFCRNIRYGBOZ") returned 0x14 [0107.847] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.847] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0107.847] CharUpperBuffW (in: lpsz="JHEUBZNWULMCVYSZIWHO", cchLength=0x14 | out: lpsz="JHEUBZNWULMCVYSZIWHO") returned 0x14 [0107.847] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0107.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x10243a8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceW", lpUsedDefaultChar=0x0) returned 14 [0107.848] GetProcAddress (hModule=0x777b0000, lpProcName="FindResourceW") returned 0x777f3e61 [0107.848] FindResourceW (hModule=0x0, lpName="DataUsageLiveTileTask2", lpType=0xa) returned 0x4b74a8 [0107.848] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0107.848] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0107.848] CharUpperBuffW (in: lpsz="LZXDYKDLWYEUUZHLDWMY", cchLength=0x14 | out: lpsz="LZXDYKDLWYEUUZHLDWMY") returned 0x14 [0107.848] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.848] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.849] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0107.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x1023748, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SizeofResource", lpUsedDefaultChar=0x0) returned 15 [0107.849] GetProcAddress (hModule=0x777b0000, lpProcName="SizeofResource") returned 0x777f3e7f [0107.849] SizeofResource (hModule=0x0, hResInfo=0x4b74a8) returned 0x50611 [0107.849] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0107.849] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.849] CharUpperBuffW (in: lpsz="DCSTEJJRTZWI_QDXAZHL", cchLength=0x14 | out: lpsz="DCSTEJJRTZWI_QDXAZHL") returned 0x14 [0107.850] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.850] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.850] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0107.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x1024078, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoadResource", lpUsedDefaultChar=0x0) returned 13 [0107.850] GetProcAddress (hModule=0x777b0000, lpProcName="LoadResource") returned 0x777f984d [0107.850] LoadResource (hModule=0x0, hResInfo=0x4b74a8) returned 0x4bf508 [0107.851] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0107.851] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.851] CharUpperBuffW (in: lpsz="KAMA_G_MVOPZHGX_NHVN", cchLength=0x14 | out: lpsz="KAMA_G_MVOPZHGX_NHVN") returned 0x14 [0107.851] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.851] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0107.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0107.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x10238b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LockResource", lpUsedDefaultChar=0x0) returned 13 [0107.852] GetProcAddress (hModule=0x777b0000, lpProcName="LockResource") returned 0x777efd29 [0107.852] LockResource (hResData=0x4bf508) returned 0x4bf508 [0107.852] CharUpperBuffW (in: lpsz="IQOZHBYWTDLIHUPBFBUV", cchLength=0x14 | out: lpsz="IQOZHBYWTDLIHUPBFBUV") returned 0x14 [0107.852] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0107.852] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0107.877] CharUpperBuffW (in: lpsz="DECDATA", cchLength=0x7 | out: lpsz="DECDATA") returned 0x7 [0107.891] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.892] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.892] CharUpperBuffW (in: lpsz="PRWRLUFYJZWBMKYOBTGF", cchLength=0x14 | out: lpsz="PRWRLUFYJZWBMKYOBTGF") returned 0x14 [0107.892] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.893] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.893] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.893] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.893] CharUpperBuffW (in: lpsz="IDXQIICQQWKNZSJCQWXO", cchLength=0x14 | out: lpsz="IDXQIICQQWKNZSJCQWXO") returned 0x14 [0107.893] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.893] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.893] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.893] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.894] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.894] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.894] CharUpperBuffW (in: lpsz="XWIXBQLSBNHDNALKQPYB", cchLength=0x14 | out: lpsz="XWIXBQLSBNHDNALKQPYB") returned 0x14 [0107.894] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.894] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x22e0020, cbMultiByte=658467, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 658467 [0107.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x22e0020, cbMultiByte=658467, lpWideCharStr=0x24e0020, cchWideChar=658467 | out: lpWideCharStr="0x5FBC5279FFBB4A14E7EF5808CAB5D50DA38AC491F22890CAA7720ACB4B679CBF19629C6F2E09A4689BB245B1AB1CCAE4411D6321E6526DC0375540C76DA9D18611FA292B7AA9441CBC45B7BB6A7E5F35C2920C0620B2C84F76DED5137EF3F7250F5CA14D1AC7C2596B1F3C395448740D77B9FF5783415E585BF3D956AE2F6FC979DE4FD47570A7F3E2C6C194CD11F2A0F4F8AF1CB4029B5728B1E2ED9124C824F62B834BE282CE195D58C039BE00D588403BD4B6B21D33EF8BB45CE1D05829011D6D43F41EF1971B8CB44E0EDD38F5B21F9E40E2D3A24543BE68F6EAEC5111C3E91B4C20894ED7EAD29D95FEFB0EA3F54DC66E61AD5B576D882719A22F6C72E3501F16817D36717BF270500B0DA3C1D9C8E8872DF307DF897F5F9D81CCE8694919C0DE7CA4005FD5451CF840D1EFD86837FCA89E33E5EB4F85515079E2B088D3ECD4596A9519DB62F7029FF84284AA888B1F4AB2128911E9C407D9D8C474ABCF19BBC82C27E1EA121821276C35C57423BC231C7A79E4864EDC44AAB1618D814D72A131CC840D5C56984223D602322F94B708FF5754BBF7C273A5011D01A72448152896B994384C9B8E310A1A998A682AFD286AC73FDD34C5BFC9CE5FF384E74003841F78E592CF1ED831D79D673082076DD46686399F1CC269FECEE421D4E4D6463968F874697012C844258C5FC1698E4DAB86F9750AE14B66BEA0067F71EC7A05BED0D3EEB5C4925927FF44354C58A8D797D31296531A7BFE77775C07D0A459495EDE15DA56F7D93F1AE3E474C2C8F90DBBB1460758ABBF89DCAC3DB4BB53CF6EC09C6560022740DE8321443C4047597F4B507F87219C7768CA364A55E1E0F438E46748DDC93A51EE3889E31993ECED83A2100FE645EE5AC536CC6C968844568D9E5EDF84CF2F45A6679220EAFC4C25C9C7940CF89CEB8DBA0A6C2AB9C5B763A777E8DDFE7F564F1AF85051282C23CBDA3186BC1DB775DA91853331B394BD582EA4D470226C4071D61DBA7DB4D74A70113ABB8EA62F0727913378DB04F0F7A57DA4EC5D910A45D51E6A4BE09AF06FDFA6F3B69330707C045F27BEE25C99B11635002F6A55EC3B6C8339B39EBDB2357FDD1C442290A4A14488E6AA70BF5CF226376B6B8D3744C9B4BBD9083AB724868933D956CDFFD575206844BD6F5056A8767CBE9B33F53DDDA0969A19F8C9CB84104B9BE4846A7E109E766F3A0A19E303F3845BAC101548D5A6B2C62D9C8D0A272B7D69B97CECAB20C36E17A43839772BBE2E9334995A620E4C4EF51D14EAC6CB747ABF3BAE24055B898D4A979C4D44FED3565A3CB300CCAAC4692F2F3F963B1F3207751AABD0DB7AFB87A63DA027D1FD15F6FCDEFB8D93D2AB4C7CC992F35B7B6E8E65EC95870BEC7C8A5CFF9DC497145224B757CDD75F794A74968BE92699600B5F6C9910E4BEC334F38AAAAF3CD319141666A5CAF2E7D9E0B887DEB6F5462BC36F97ADAAA091070EFB53D1487D1332512CF79E96FE9DCE915CC9D09EC91C981988F540F9E21793EE9A4BA58AEB2D71E3DEFFDDE19BC84D94BACA7C6922D4A639591635AD67D467FD045B50D2EC13D593F448C8A829F8AEF3E25ACCA0CBC389F92DEED05AD11F46630BAF365C57F268851CB7D909A7409D486EA57837D39B54A658926A67847EE742431B7158B0896B7F501DC406B7DF04673523B92E47EB5B58CEF2F106F274240BC86C3194B96EB49A0E02E68B942F4D22F869E1008C8C4DC5DFC4E93C142612C4AE42B06CF79F29EA969175BC438E562D46078CFAC536123C05600919A51FB978B77A8C5849769A36DAC2EA6CCBBF856126BC11FF11724CE1A47A6C3D8D87BE5145D2EDED9902772EF55CEF8434DCD8C4E7CDDE02E9EA7CDBD5C7B1F99E6B81F42C63DCF9A6F0B79BB12DCD85333EB5892DD13EB9ED76657427B0D58312EEB5004DCECD7330E3AD178A7C0BAF2F2E1104485D39C9675123047F156AEACBCF709619D4F9530BB81A03CD01016218143DD2B3F866172AE80A14AE87E25AF081A5E6468708331C741F1B35ED5E30983376114616A07286F72E9715EDBE397269CB9B25C16ACCFD015C8FC0BFD7076BA52FAF1C62709252096C202564915D70E3A37FD915C01F39D712030ED9154E91222BD157065E1718B70774C0C48B99055A0C544FF3DA8B18E3E17497441A3996C53180D5A4B384642779C05B9698723D092C8BE8D438BF2F9C5DAB28C6D442F864D53F13EAD8499C26DD7A289CC968A89D4BC4104A23C4839F0BF92E667DB2644E9080E702BC09B3EA5CDE6F5FA6C6DF1BCF60B3BF7809DA61393C36D6F1D09D8A3FCB3C049242D4C9E0157AA85E7A2EA28E28690BA2DBB0BB7F2D0E35F8245EB2555CF3EC3FA7C845D7E3DB20DD03CFECDCD89EBBB998CD15C4DFA93C4D126376A41BBB6C2507EED9B5E0EDB4CDD26BC0163D17EEE656A209C46EA8C8C6CE240927488EEB3F4051BCAA344887DFC73C986BB35C81D5E72EBD822494E741BB749B0E072EBD9F5CE90AF76B78D6AC966D58E4E5D49FE8E3C454CDC1D2C26317AFEED2864147D175814A5A5147C390C88355F098C8F42043990315B92CDF9ACA15BDD56DBD2236A0251D124F1AA3D1701FC03362F43D1A12957A2533954D409F36504E5CC5B3D38D69487DAB030500B5F04CBFC71FBA966376CF37CF3A5FBC15B90E43724BCE32D4F228D20C3CB0E4F3A8D3BB300618E8031D5AFD537EBA8EAB371CCB8F90BCD587E2AEC54A66F489A84434ABAB36C936C38ACAFB15632B62E138CA6AC7E171A71C35C468F9AD3A39E70CC0250C9E9883AF01BF54EFA289CC19422D100C16098C9425CC449008ADCD6DC095D098E6D0AB421DCE0991512992BAF0C215EDCADCFEBF322D777CC86BECBBDA57330D55DC64745DA07604E5EA75240A9FDEA1536E5389007789197220F9E5614CD7B40116D3C772275B4D56C3F3AEB4E1A82A3ED41561F74605BCFECF368637B9C66B0F0989733F4C87A9A4DE27349479D2ED664FADC9E4AFC64912280804869DAD3FC69C994F9CA69FA10F75635B9A62AD8BAAB07995663B086651096B6B70747FA5149F9E6E7840E241AE2F16E3B27AAAD5B653D409F93AF4DBC6015569E305B82E38355A4D5AF1686B27ED5011578A758A1410D10D1262E5AE81AEEF7E8E106B4A815BD7D663FB35FEC96524FC7FADA188E0FD66F1E934079A7BF099C448E4335D4567F4FC79A1562C9B53EFD1B98331B587F58B38C678F6089591161AB8B5845107BC317973FEFCB09830665EC56C8769FA2E89B59AD058B5E9036202B2636E580FC1E643164B1AC6EA294D1B7DDE75940A3406A085D7AD1116258A0CC7443DF90DCE14152EC1B65B0E4AA62D25AF9AB47CA0541E146952BADBCC5BF52C04820EE5C8833CB1DDFC3266BC59415CAE5278CDC1F90ABF4C905DA9D450860BEE7C733798E3923F20E508EE43BD789C3FEC662F5E1A10BBAD7F46D92663862FD1828306F0AB40D489C7A6986021F707FC6851CB46B6E36AC08D8FB228FF98AE2DE1F40914456E983A50A47762B63044B6DAF5DBAD358BCA6BBC22D33F49BBA937B80CA70D060F764323340BD371CEF4ACC4870078750BEDC7A416E381EB6869F5B621C9750C2C83943") returned 658467 [0107.958] CharUpperBuffW (in: lpsz="MMBKMWVJWOGCINWBGHEI", cchLength=0x14 | out: lpsz="MMBKMWVJWOGCINWBGHEI") returned 0x14 [0107.958] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76f70000 [0107.959] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0107.959] CharUpperBuffW (in: lpsz="SKIRTGLRHOFWUQUUQYOD", cchLength=0x14 | out: lpsz="SKIRTGLRHOFWUQUUQYOD") returned 0x14 [0107.959] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0107.959] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.959] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.959] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.960] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.960] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.960] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.960] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.960] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.960] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0107.960] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0107.961] CharUpperBuffW (in: lpsz="BNN_VUOZHLCAXYVQU_RM", cchLength=0x14 | out: lpsz="BNN_VUOZHLCAXYVQU_RM") returned 0x14 [0107.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0107.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0xc9f6c0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0107.961] GetProcAddress (hModule=0x76f70000, lpProcName="CryptAcquireContext") returned 0x0 [0107.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0107.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0xc9f6c0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0107.961] GetProcAddress (hModule=0x76f70000, lpProcName="CryptAcquireContextA") returned 0x76f791dd [0107.962] CryptAcquireContextA (in: phProv=0xbaef80, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xbaef80*=0xcde370) returned 1 [0107.981] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.981] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0107.981] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0107.981] CharUpperBuffW (in: lpsz="ABKWPVNUENAVQACYEFTI", cchLength=0x14 | out: lpsz="ABKWPVNUENAVQACYEFTI") returned 0x14 [0107.982] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0107.982] CharUpperBuffW (in: lpsz="PKQYPLUXIWNVIUIEYBXY", cchLength=0x14 | out: lpsz="PKQYPLUXIWNVIUIEYBXY") returned 0x14 [0107.982] CharUpperBuffW (in: lpsz="KNNAIYDHZSRCVRFNBHZF", cchLength=0x14 | out: lpsz="KNNAIYDHZSRCVRFNBHZF") returned 0x14 [0107.982] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0107.982] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.982] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.982] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0107.983] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.983] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.983] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0107.983] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.983] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0107.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1025020, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0107.983] GetProcAddress (hModule=0x76f70000, lpProcName="CryptCreateHash") returned 0x76f7df4e [0107.984] CryptCreateHash (in: hProv=0xcde370, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xbaefc8 | out: phHash=0xbaefc8) returned 1 [0107.984] CharUpperBuffW (in: lpsz="JFTVYKADTXOLYOSYZOAY", cchLength=0x14 | out: lpsz="JFTVYKADTXOLYOSYZOAY") returned 0x14 [0107.984] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0107.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0107.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", cchWideChar=51, lpMultiByteStr=0x10079c0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", lpUsedDefaultChar=0x0) returned 51 [0107.984] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0107.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0107.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", cchWideChar=51, lpMultiByteStr=0x1007a00, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="throzgyntpcubfujatkyowktjgeqwxcsvphecepbzxorruxruw", lpUsedDefaultChar=0x0) returned 51 [0107.985] CharUpperBuffW (in: lpsz="YHNGDJBMMGM_MOVOJOFD", cchLength=0x14 | out: lpsz="YHNGDJBMMGM_MOVOJOFD") returned 0x14 [0107.985] CharUpperBuffW (in: lpsz="AWRLSHYJRTOGTGYECYTE", cchLength=0x14 | out: lpsz="AWRLSHYJRTOGTGYECYTE") returned 0x14 [0107.985] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0107.985] CharUpperBuffW (in: lpsz="TEQWXYVQXQTHQMKGBQMX", cchLength=0x14 | out: lpsz="TEQWXYVQXQTHQMKGBQMX") returned 0x14 [0107.985] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0107.986] CharUpperBuffW (in: lpsz="_KGEVVOZKJJCBGPELJNU", cchLength=0x14 | out: lpsz="_KGEVVOZKJJCBGPELJNU") returned 0x14 [0107.986] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0107.986] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0107.986] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0107.986] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0107.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0107.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1023b38, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0107.987] GetProcAddress (hModule=0x76f70000, lpProcName="CryptHashData") returned 0x76f7df36 [0107.987] CryptHashData (hHash=0x1007880, pbData=0x1007940, dwDataLen=0x32, dwFlags=0x0) returned 1 [0107.987] CharUpperBuffW (in: lpsz="HJMKOMUFBVOESN_YGRAC", cchLength=0x14 | out: lpsz="HJMKOMUFBVOESN_YGRAC") returned 0x14 [0107.987] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0107.987] CharUpperBuffW (in: lpsz="JWHXOPFWQMM_RWIDFEIZ", cchLength=0x14 | out: lpsz="JWHXOPFWQMM_RWIDFEIZ") returned 0x14 [0107.987] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0107.988] CharUpperBuffW (in: lpsz="PKQYPLUXIWNVIUIEYBXY", cchLength=0x14 | out: lpsz="PKQYPLUXIWNVIUIEYBXY") returned 0x14 [0107.988] CharUpperBuffW (in: lpsz="RKOBNPFBPHXZWQZEEFKL", cchLength=0x14 | out: lpsz="RKOBNPFBPHXZWQZEEFKL") returned 0x14 [0107.988] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0107.988] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0107.988] CharUpperBuffW (in: lpsz="SBWDVAJARWXSENESDBPB", cchLength=0x14 | out: lpsz="SBWDVAJARWXSENESDBPB") returned 0x14 [0107.988] CharUpperBuffW (in: lpsz="BTYFJZBLYMPJINWLTHZG", cchLength=0x14 | out: lpsz="BTYFJZBLYMPJINWLTHZG") returned 0x14 [0107.988] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0107.989] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0107.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0107.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1024930, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0107.989] GetProcAddress (hModule=0x76f70000, lpProcName="CryptDeriveKey") returned 0x76fb3188 [0107.989] CryptDeriveKey (in: hProv=0xcde370, Algid=0x6610, hBaseData=0x1007880, dwFlags=0x1, phKey=0xbaefc8 | out: phKey=0xbaefc8*=0x10079c0) returned 1 [0107.990] CharUpperBuffW (in: lpsz="NPEGDBGBJXFHDYAVULHL", cchLength=0x14 | out: lpsz="NPEGDBGBJXFHDYAVULHL") returned 0x14 [0107.990] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0107.990] CharUpperBuffW (in: lpsz="GRPZSIBHHZBJMXFNJCJQ", cchLength=0x14 | out: lpsz="GRPZSIBHHZBJMXFNJCJQ") returned 0x14 [0107.990] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0107.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0107.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xc9fc40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0107.995] GetProcAddress (hModule=0x76f70000, lpProcName="CryptDestroyHash") returned 0x76f7df66 [0107.995] CryptDestroyHash (hHash=0x1007880) returned 1 [0107.995] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0108.145] CharUpperBuffW (in: lpsz="RTVNJRJDKSCKHKDVEEKZ", cchLength=0x14 | out: lpsz="RTVNJRJDKSCKHKDVEEKZ") returned 0x14 [0108.145] CharUpperBuffW (in: lpsz="1000", cchLength=0x4 | out: lpsz="1000") returned 0x4 [0108.145] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0108.157] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0108.157] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0108.173] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0108.173] PeekMessageW (in: lpMsg=0xbaf7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaf7cc) returned 0 [0108.174] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0108.174] CharUpperBuffW (in: lpsz="ZGGVWCXEDJQTJHMNMJGB", cchLength=0x14 | out: lpsz="ZGGVWCXEDJQTJHMNMJGB") returned 0x14 [0108.174] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0108.174] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0108.174] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0108.174] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0108.174] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0108.175] CharUpperBuffW (in: lpsz="IOJYQLNEPPCVOOCOKOTX", cchLength=0x14 | out: lpsz="IOJYQLNEPPCVOOCOKOTX") returned 0x14 [0108.175] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0108.175] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0108.175] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0108.175] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0108.175] CharUpperBuffW (in: lpsz="_KGEVVOZKJJCBGPELJNU", cchLength=0x14 | out: lpsz="_KGEVVOZKJJCBGPELJNU") returned 0x14 [0108.175] CharUpperBuffW (in: lpsz="NVVLEDLWQZQCMBOKPSCF", cchLength=0x14 | out: lpsz="NVVLEDLWQZQCMBOKPSCF") returned 0x14 [0108.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDecrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0108.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDecrypt", cchWideChar=13, lpMultiByteStr=0x1025188, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDecrypt", lpUsedDefaultChar=0x0) returned 13 [0108.189] GetProcAddress (hModule=0x76f70000, lpProcName="CryptDecrypt") returned 0x76fb3178 [0108.189] CryptDecrypt (in: hKey=0x10079c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1f20048, pdwDataLen=0xbaefe0 | out: pbData=0x1f20048, pdwDataLen=0xbaefe0) returned 1 [0108.192] CharUpperBuffW (in: lpsz="FMZXLSJHHMLTZENDAMYM", cchLength=0x14 | out: lpsz="FMZXLSJHHMLTZENDAMYM") returned 0x14 [0108.193] CharUpperBuffW (in: lpsz="GOQEEHSMEPRUOBDQKWUP", cchLength=0x14 | out: lpsz="GOQEEHSMEPRUOBDQKWUP") returned 0x14 [0108.193] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0108.193] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0108.193] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0108.193] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0108.193] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0108.194] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0108.200] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0108.200] CharUpperBuffW (in: lpsz="FBNVQRDBUQMRSQUPZEVG", cchLength=0x14 | out: lpsz="FBNVQRDBUQMRSQUPZEVG") returned 0x14 [0108.201] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0108.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0108.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x10248b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0108.201] GetProcAddress (hModule=0x76f70000, lpProcName="CryptDestroyKey") returned 0x76f7c51a [0108.201] CryptDestroyKey (hKey=0x10079c0) returned 1 [0108.202] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0108.202] CharUpperBuffW (in: lpsz="FBNVQRDBUQMRSQUPZEVG", cchLength=0x14 | out: lpsz="FBNVQRDBUQMRSQUPZEVG") returned 0x14 [0108.202] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0108.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0108.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1023880, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0108.203] GetProcAddress (hModule=0x76f70000, lpProcName="CryptDestroyKey") returned 0x76f7c51a [0108.203] CryptDestroyKey (hKey=0x10079c0) returned 0 [0108.203] CharUpperBuffW (in: lpsz="PHJZQBHGBLSQFJXCPK_M", cchLength=0x14 | out: lpsz="PHJZQBHGBLSQFJXCPK_M") returned 0x14 [0108.203] CharUpperBuffW (in: lpsz="CTYBBOQRCOKGY_BYPIOE", cchLength=0x14 | out: lpsz="CTYBBOQRCOKGY_BYPIOE") returned 0x14 [0108.203] CharUpperBuffW (in: lpsz="1", cchLength=0x1 | out: lpsz="1") returned 0x1 [0108.203] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0108.203] CharUpperBuffW (in: lpsz="ECKMEMCHDOSIWWCIKFWC", cchLength=0x14 | out: lpsz="ECKMEMCHDOSIWWCIKFWC") returned 0x14 [0108.204] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0108.204] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0108.204] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0108.204] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0108.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0108.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0xc9fc60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0108.204] GetProcAddress (hModule=0x76f70000, lpProcName="CryptReleaseContext") returned 0x76f7e124 [0108.204] CryptReleaseContext (hProv=0xcde370, dwFlags=0x0) returned 1 [0108.205] FreeLibrary (hLibModule=0x76f70000) returned 1 [0108.205] CharUpperBuffW (in: lpsz="EBHLYPIUKAVZA_OGNFLT", cchLength=0x14 | out: lpsz="EBHLYPIUKAVZA_OGNFLT") returned 0x14 [0108.231] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xbaf430 | out: pszPath="C:\\Users\\JPenUM\\AppData\\Roaming") returned 0x0 [0108.231] CharUpperBuffW (in: lpsz="TPAGBHUBMCHOAAR", cchLength=0xf | out: lpsz="TPAGBHUBMCHOAAR") returned 0xf [0108.231] CharUpperBuffW (in: lpsz="PGDJXQUTWMMUIQOFFEWQ", cchLength=0x14 | out: lpsz="PGDJXQUTWMMUIQOFFEWQ") returned 0x14 [0108.231] CharUpperBuffW (in: lpsz="LAJPUUBTAUPYKYTXN", cchLength=0x11 | out: lpsz="LAJPUUBTAUPYKYTXN") returned 0x11 [0108.231] CharUpperBuffW (in: lpsz="TMSKQOPVNSFXQQUYIFSK", cchLength=0x14 | out: lpsz="TMSKQOPVNSFXQQUYIFSK") returned 0x14 [0108.232] CharUpperBuffW (in: lpsz="YUXQUJTAPNSAJSQQGRCF", cchLength=0x14 | out: lpsz="YUXQUJTAPNSAJSQQGRCF") returned 0x14 [0108.232] CharUpperBuffW (in: lpsz="ZYQMYIHPZIAQJHXMDIAJ", cchLength=0x14 | out: lpsz="ZYQMYIHPZIAQJHXMDIAJ") returned 0x14 [0108.232] CharUpperBuffW (in: lpsz="ANGILWRLDVDE_PXWBSEL", cchLength=0x14 | out: lpsz="ANGILWRLDVDE_PXWBSEL") returned 0x14 [0108.233] CharUpperBuffW (in: lpsz="CRQEQZZLGAEPYQKCYUVH", cchLength=0x14 | out: lpsz="CRQEQZZLGAEPYQKCYUVH") returned 0x14 [0108.233] GetWindowTextW (in: hWnd=0x10066, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.233] GetClassNameW (in: hWnd=0x10066, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.233] GetWindowTextW (in: hWnd=0x10064, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.233] GetClassNameW (in: hWnd=0x10064, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.233] GetWindowTextW (in: hWnd=0x10050, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.233] GetClassNameW (in: hWnd=0x10050, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.233] GetWindowTextW (in: hWnd=0x10078, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.233] GetClassNameW (in: hWnd=0x10078, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.233] GetWindowTextW (in: hWnd=0x1006e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.233] GetClassNameW (in: hWnd=0x1006e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.233] GetWindowTextW (in: hWnd=0x1006c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.233] GetClassNameW (in: hWnd=0x1006c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.233] GetWindowTextW (in: hWnd=0x10068, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.233] GetClassNameW (in: hWnd=0x10068, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.233] GetWindowTextW (in: hWnd=0x10048, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Start") returned 5 [0108.233] GetClassNameW (in: hWnd=0x10048, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0108.233] GetWindowTextW (in: hWnd=0x2001e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.233] GetClassNameW (in: hWnd=0x2001e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0108.233] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0108.233] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0108.234] GetWindowTextW (in: hWnd=0x10114, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0108.234] GetClassNameW (in: hWnd=0x10114, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0108.234] GetWindowTextW (in: hWnd=0x100da, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x100da, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x100bc, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x100bc, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x10094, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x10094, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x50082, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x50082, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x1007a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x1007a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0108.234] GetWindowTextW (in: hWnd=0x1008c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0108.234] GetClassNameW (in: hWnd=0x1008c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0108.234] GetWindowTextW (in: hWnd=0x2022c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x2022c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x301b8, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x301b8, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x3019a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x3019a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x20228, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x20228, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x20238, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x20238, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x20234, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.234] GetClassNameW (in: hWnd=0x20234, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.234] GetWindowTextW (in: hWnd=0x20220, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x20220, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x2025c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x2025c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x20266, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x20266, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x20268, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x20268, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x20246, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x20246, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x20254, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x20254, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x20250, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x2024a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x2024a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x2024c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x2024c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x2021e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x2021e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x2020e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x2020e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x20216, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.235] GetClassNameW (in: hWnd=0x20216, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.235] GetWindowTextW (in: hWnd=0x201f6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0108.235] GetClassNameW (in: hWnd=0x201f6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0108.235] GetWindowTextW (in: hWnd=0x701ae, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0108.235] DefWindowProcW (hWnd=0x701ae, Msg=0xd, wParam=0x400, lParam=0xbae3f8) returned 0x9 [0108.236] GetClassNameW (in: hWnd=0x701ae, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0108.236] GetWindowTextW (in: hWnd=0x300e6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="TaskEng - Task Scheduler Engine Process") returned 39 [0108.236] GetClassNameW (in: hWnd=0x300e6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0108.236] GetWindowTextW (in: hWnd=0x30282, lpString=0xbae3f8, nMaxCount=1024 | out: lpString=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0108.236] GetClassNameW (in: hWnd=0x30282, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0108.236] GetWindowTextW (in: hWnd=0x20286, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.236] GetClassNameW (in: hWnd=0x20286, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.236] GetWindowTextW (in: hWnd=0x30130, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0108.236] GetClassNameW (in: hWnd=0x30130, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0108.236] GetWindowTextW (in: hWnd=0x20198, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Oil") returned 3 [0108.236] GetClassNameW (in: hWnd=0x20198, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0108.236] GetWindowTextW (in: hWnd=0x20178, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0108.236] GetClassNameW (in: hWnd=0x20178, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0108.236] GetWindowTextW (in: hWnd=0x20176, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Runner") returned 6 [0108.236] GetClassNameW (in: hWnd=0x20176, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0108.236] GetWindowTextW (in: hWnd=0x2016e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0108.236] GetClassNameW (in: hWnd=0x2016e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0108.236] GetWindowTextW (in: hWnd=0x2016a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0108.236] GetClassNameW (in: hWnd=0x2016a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0108.236] GetWindowTextW (in: hWnd=0x3019e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0108.236] GetClassNameW (in: hWnd=0x3019e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0108.236] GetWindowTextW (in: hWnd=0x30188, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0108.236] GetClassNameW (in: hWnd=0x30188, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0108.236] GetWindowTextW (in: hWnd=0x20164, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Charging") returned 8 [0108.236] GetClassNameW (in: hWnd=0x20164, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0108.236] GetWindowTextW (in: hWnd=0x20160, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0108.236] GetClassNameW (in: hWnd=0x20160, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0108.236] GetWindowTextW (in: hWnd=0x2015c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0108.237] GetClassNameW (in: hWnd=0x2015c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0108.237] GetWindowTextW (in: hWnd=0x20158, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0108.237] GetClassNameW (in: hWnd=0x20158, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0108.237] GetWindowTextW (in: hWnd=0x40152, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0108.237] GetClassNameW (in: hWnd=0x40152, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0108.237] GetWindowTextW (in: hWnd=0xd013a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0108.237] GetClassNameW (in: hWnd=0xd013a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0108.237] GetWindowTextW (in: hWnd=0x301bc, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0108.237] GetClassNameW (in: hWnd=0x301bc, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0108.237] GetWindowTextW (in: hWnd=0x300dc, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0108.237] GetClassNameW (in: hWnd=0x300dc, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0108.237] GetWindowTextW (in: hWnd=0x30174, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0108.237] GetClassNameW (in: hWnd=0x30174, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0108.237] GetWindowTextW (in: hWnd=0x20148, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0108.237] GetClassNameW (in: hWnd=0x20148, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0108.237] GetWindowTextW (in: hWnd=0x20142, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0108.237] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0108.237] GetWindowTextW (in: hWnd=0x30144, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0108.237] GetClassNameW (in: hWnd=0x30144, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0108.237] GetWindowTextW (in: hWnd=0x901b0, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0108.237] GetClassNameW (in: hWnd=0x901b0, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0108.237] GetWindowTextW (in: hWnd=0x501a4, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0108.237] GetClassNameW (in: hWnd=0x501a4, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0108.237] GetWindowTextW (in: hWnd=0x201a8, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0108.237] GetClassNameW (in: hWnd=0x201a8, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0108.237] GetWindowTextW (in: hWnd=0x2014e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.237] GetClassNameW (in: hWnd=0x2014e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0108.237] GetWindowTextW (in: hWnd=0x101be, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0108.238] GetClassNameW (in: hWnd=0x101be, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0108.238] GetWindowTextW (in: hWnd=0x4013c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0108.238] GetClassNameW (in: hWnd=0x4013c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0108.238] GetWindowTextW (in: hWnd=0x10128, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0108.238] GetClassNameW (in: hWnd=0x10128, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0108.238] GetWindowTextW (in: hWnd=0x20126, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0108.238] GetClassNameW (in: hWnd=0x20126, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0108.238] GetWindowTextW (in: hWnd=0x2011a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.238] GetClassNameW (in: hWnd=0x2011a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0108.238] GetWindowTextW (in: hWnd=0x1010a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0108.238] GetClassNameW (in: hWnd=0x1010a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0108.238] GetWindowTextW (in: hWnd=0x10102, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.238] GetClassNameW (in: hWnd=0x10102, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0108.238] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0108.238] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0108.238] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.238] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.238] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.238] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.238] GetWindowTextW (in: hWnd=0x20034, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.238] GetClassNameW (in: hWnd=0x20034, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.238] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.238] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.238] GetWindowTextW (in: hWnd=0x100c2, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.238] GetClassNameW (in: hWnd=0x100c2, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0108.238] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.238] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0108.238] GetWindowTextW (in: hWnd=0x100ac, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.238] GetClassNameW (in: hWnd=0x100ac, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.239] GetWindowTextW (in: hWnd=0x100a6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.239] GetClassNameW (in: hWnd=0x100a6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.239] GetWindowTextW (in: hWnd=0x200a0, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.239] GetClassNameW (in: hWnd=0x200a0, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.239] GetWindowTextW (in: hWnd=0x10086, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0108.239] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0108.239] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0108.239] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0108.239] GetWindowTextW (in: hWnd=0x40024, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.239] GetClassNameW (in: hWnd=0x40024, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.239] GetWindowTextW (in: hWnd=0x10072, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.239] GetClassNameW (in: hWnd=0x10072, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.239] GetWindowTextW (in: hWnd=0x1006a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.239] GetClassNameW (in: hWnd=0x1006a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.239] GetWindowTextW (in: hWnd=0x10058, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.239] GetClassNameW (in: hWnd=0x10058, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.239] GetWindowTextW (in: hWnd=0x100e2, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.239] GetClassNameW (in: hWnd=0x100e2, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.239] GetWindowTextW (in: hWnd=0x10054, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.239] GetClassNameW (in: hWnd=0x10054, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0108.239] GetWindowTextW (in: hWnd=0x2001a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0108.239] GetClassNameW (in: hWnd=0x2001a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0108.239] GetWindowTextW (in: hWnd=0x30028, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.239] GetClassNameW (in: hWnd=0x30028, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0108.239] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.239] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0108.239] GetWindowTextW (in: hWnd=0x1003a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0108.239] GetClassNameW (in: hWnd=0x1003a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0108.240] GetWindowTextW (in: hWnd=0x1002e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0108.240] GetClassNameW (in: hWnd=0x1002e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0108.240] GetWindowTextW (in: hWnd=0x10036, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.240] GetClassNameW (in: hWnd=0x10036, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0108.240] GetWindowTextW (in: hWnd=0x30026, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0108.240] GetClassNameW (in: hWnd=0x30026, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0108.240] GetWindowTextW (in: hWnd=0x100d0, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0108.240] GetClassNameW (in: hWnd=0x100d0, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0108.240] GetWindowTextW (in: hWnd=0x20020, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0108.240] GetClassNameW (in: hWnd=0x20020, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0108.240] GetWindowTextW (in: hWnd=0x20022, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.240] GetClassNameW (in: hWnd=0x20022, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.240] GetWindowTextW (in: hWnd=0x10116, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.240] GetClassNameW (in: hWnd=0x10116, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.240] GetWindowTextW (in: hWnd=0x2022e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0108.240] GetClassNameW (in: hWnd=0x2022e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0108.240] GetWindowTextW (in: hWnd=0x301f8, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.240] GetClassNameW (in: hWnd=0x301f8, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.240] GetWindowTextW (in: hWnd=0x20242, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x20242, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x40204, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x40204, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x20278, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x20278, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x30200, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x30200, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x201d2, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x201d2, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x20182, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x20182, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x20180, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x20180, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x20170, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x20170, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x2016c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x2016c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x20168, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x20168, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x3019c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x3019c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x20166, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x20166, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x20162, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x20162, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x2015e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.242] GetClassNameW (in: hWnd=0x2015e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.242] GetWindowTextW (in: hWnd=0x2015a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x2015a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x20156, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x20156, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x40150, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x40150, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x201ba, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x201ba, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x20172, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x20172, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x4010e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x4010e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x2014a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x2014a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x20146, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x20146, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x30140, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x30140, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x20154, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x20154, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x101c0, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x101c0, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x1010c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x1010c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x10104, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.243] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.243] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.244] GetWindowTextW (in: hWnd=0x1003c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.244] GetClassNameW (in: hWnd=0x1003c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.244] GetWindowTextW (in: hWnd=0x10030, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.244] GetClassNameW (in: hWnd=0x10030, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.244] GetWindowTextW (in: hWnd=0x10038, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.244] GetClassNameW (in: hWnd=0x10038, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.244] GetWindowTextW (in: hWnd=0x100ec, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0108.244] GetClassNameW (in: hWnd=0x100ec, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0108.244] GetWindowTextW (in: hWnd=0x2002a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.244] GetClassNameW (in: hWnd=0x2002a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.244] CharUpperBuffW (in: lpsz="HAMOKBAMRNQLQWNMQBAB", cchLength=0x14 | out: lpsz="HAMOKBAMRNQLQWNMQBAB") returned 0x14 [0108.245] GetWindowTextW (in: hWnd=0x10066, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.245] GetClassNameW (in: hWnd=0x10066, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.245] GetWindowTextW (in: hWnd=0x10064, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.245] GetClassNameW (in: hWnd=0x10064, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.245] GetWindowTextW (in: hWnd=0x10050, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.245] GetClassNameW (in: hWnd=0x10050, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.245] GetWindowTextW (in: hWnd=0x10078, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.245] GetClassNameW (in: hWnd=0x10078, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.245] GetWindowTextW (in: hWnd=0x1006e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.245] GetClassNameW (in: hWnd=0x1006e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.245] GetWindowTextW (in: hWnd=0x1006c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.245] GetClassNameW (in: hWnd=0x1006c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.245] GetWindowTextW (in: hWnd=0x10068, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.245] GetClassNameW (in: hWnd=0x10068, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.245] GetWindowTextW (in: hWnd=0x10048, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Start") returned 5 [0108.245] GetClassNameW (in: hWnd=0x10048, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0108.245] GetWindowTextW (in: hWnd=0x2001e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.245] GetClassNameW (in: hWnd=0x2001e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0108.245] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0108.245] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0108.245] GetWindowTextW (in: hWnd=0x10114, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0108.245] GetClassNameW (in: hWnd=0x10114, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0108.246] GetWindowTextW (in: hWnd=0x100da, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x100da, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x100bc, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x100bc, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x10094, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x10094, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x50082, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x50082, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x1007a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x1007a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0108.246] GetWindowTextW (in: hWnd=0x1008c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0108.246] GetClassNameW (in: hWnd=0x1008c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0108.246] GetWindowTextW (in: hWnd=0x2022c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x2022c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x301b8, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x301b8, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x3019a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x3019a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x20228, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x20228, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x20238, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x20238, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x20234, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x20234, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.246] GetWindowTextW (in: hWnd=0x20220, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.246] GetClassNameW (in: hWnd=0x20220, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x2025c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x2025c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x20266, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x20266, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x20268, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x20268, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x20246, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x20246, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x20254, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x20254, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x20250, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x2024a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x2024a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x2024c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x2024c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x2021e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x2021e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x2020e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x2020e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x20216, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.247] GetClassNameW (in: hWnd=0x20216, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.247] GetWindowTextW (in: hWnd=0x201f6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0108.247] GetClassNameW (in: hWnd=0x201f6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0108.247] GetWindowTextW (in: hWnd=0x701ae, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0108.247] DefWindowProcW (hWnd=0x701ae, Msg=0xd, wParam=0x400, lParam=0xbae3f8) returned 0x9 [0108.247] GetClassNameW (in: hWnd=0x701ae, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0108.247] GetWindowTextW (in: hWnd=0x300e6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="TaskEng - Task Scheduler Engine Process") returned 39 [0108.248] GetClassNameW (in: hWnd=0x300e6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0108.248] GetWindowTextW (in: hWnd=0x30282, lpString=0xbae3f8, nMaxCount=1024 | out: lpString=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0108.248] GetClassNameW (in: hWnd=0x30282, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0108.248] GetWindowTextW (in: hWnd=0x20286, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.248] GetClassNameW (in: hWnd=0x20286, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.248] GetWindowTextW (in: hWnd=0x30130, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0108.248] GetClassNameW (in: hWnd=0x30130, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0108.248] GetWindowTextW (in: hWnd=0x20198, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Oil") returned 3 [0108.248] GetClassNameW (in: hWnd=0x20198, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0108.248] GetWindowTextW (in: hWnd=0x20178, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0108.248] GetClassNameW (in: hWnd=0x20178, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0108.248] GetWindowTextW (in: hWnd=0x20176, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Runner") returned 6 [0108.248] GetClassNameW (in: hWnd=0x20176, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0108.248] GetWindowTextW (in: hWnd=0x2016e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0108.248] GetClassNameW (in: hWnd=0x2016e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0108.248] GetWindowTextW (in: hWnd=0x2016a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0108.248] GetClassNameW (in: hWnd=0x2016a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0108.248] GetWindowTextW (in: hWnd=0x3019e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0108.248] GetClassNameW (in: hWnd=0x3019e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0108.248] GetWindowTextW (in: hWnd=0x30188, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0108.248] GetClassNameW (in: hWnd=0x30188, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0108.248] GetWindowTextW (in: hWnd=0x20164, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Charging") returned 8 [0108.248] GetClassNameW (in: hWnd=0x20164, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0108.248] GetWindowTextW (in: hWnd=0x20160, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0108.248] GetClassNameW (in: hWnd=0x20160, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0108.248] GetWindowTextW (in: hWnd=0x2015c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0108.248] GetClassNameW (in: hWnd=0x2015c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0108.248] GetWindowTextW (in: hWnd=0x20158, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0108.248] GetClassNameW (in: hWnd=0x20158, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0108.249] GetWindowTextW (in: hWnd=0x40152, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0108.249] GetClassNameW (in: hWnd=0x40152, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0108.249] GetWindowTextW (in: hWnd=0xd013a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0108.249] GetClassNameW (in: hWnd=0xd013a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0108.249] GetWindowTextW (in: hWnd=0x301bc, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0108.249] GetClassNameW (in: hWnd=0x301bc, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0108.249] GetWindowTextW (in: hWnd=0x300dc, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0108.249] GetClassNameW (in: hWnd=0x300dc, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0108.249] GetWindowTextW (in: hWnd=0x30174, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0108.249] GetClassNameW (in: hWnd=0x30174, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0108.249] GetWindowTextW (in: hWnd=0x20148, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0108.249] GetClassNameW (in: hWnd=0x20148, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0108.249] GetWindowTextW (in: hWnd=0x20142, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0108.249] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0108.249] GetWindowTextW (in: hWnd=0x30144, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0108.249] GetClassNameW (in: hWnd=0x30144, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0108.249] GetWindowTextW (in: hWnd=0x901b0, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0108.249] GetClassNameW (in: hWnd=0x901b0, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0108.249] GetWindowTextW (in: hWnd=0x501a4, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0108.249] GetClassNameW (in: hWnd=0x501a4, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0108.249] GetWindowTextW (in: hWnd=0x201a8, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0108.249] GetClassNameW (in: hWnd=0x201a8, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0108.249] GetWindowTextW (in: hWnd=0x2014e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.249] GetClassNameW (in: hWnd=0x2014e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0108.249] GetWindowTextW (in: hWnd=0x101be, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0108.249] GetClassNameW (in: hWnd=0x101be, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0108.249] GetWindowTextW (in: hWnd=0x4013c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0108.249] GetClassNameW (in: hWnd=0x4013c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0108.250] GetWindowTextW (in: hWnd=0x10128, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0108.250] GetClassNameW (in: hWnd=0x10128, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0108.250] GetWindowTextW (in: hWnd=0x20126, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0108.250] GetClassNameW (in: hWnd=0x20126, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0108.250] GetWindowTextW (in: hWnd=0x2011a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.250] GetClassNameW (in: hWnd=0x2011a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0108.250] GetWindowTextW (in: hWnd=0x1010a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0108.250] GetClassNameW (in: hWnd=0x1010a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0108.250] GetWindowTextW (in: hWnd=0x10102, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.250] GetClassNameW (in: hWnd=0x10102, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0108.250] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0108.250] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0108.250] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.250] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.250] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.250] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.250] GetWindowTextW (in: hWnd=0x20034, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.250] GetClassNameW (in: hWnd=0x20034, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.250] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.250] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.250] GetWindowTextW (in: hWnd=0x100c2, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.250] GetClassNameW (in: hWnd=0x100c2, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0108.250] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.250] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0108.250] GetWindowTextW (in: hWnd=0x100ac, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.250] GetClassNameW (in: hWnd=0x100ac, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.250] GetWindowTextW (in: hWnd=0x100a6, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.250] GetClassNameW (in: hWnd=0x100a6, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.251] GetWindowTextW (in: hWnd=0x200a0, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.251] GetClassNameW (in: hWnd=0x200a0, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.251] GetWindowTextW (in: hWnd=0x10086, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0108.251] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0108.251] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0108.251] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0108.251] GetWindowTextW (in: hWnd=0x40024, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.251] GetClassNameW (in: hWnd=0x40024, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.251] GetWindowTextW (in: hWnd=0x10072, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.251] GetClassNameW (in: hWnd=0x10072, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.251] GetWindowTextW (in: hWnd=0x1006a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.251] GetClassNameW (in: hWnd=0x1006a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.251] GetWindowTextW (in: hWnd=0x10058, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.251] GetClassNameW (in: hWnd=0x10058, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.251] GetWindowTextW (in: hWnd=0x100e2, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.251] GetClassNameW (in: hWnd=0x100e2, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.251] GetWindowTextW (in: hWnd=0x10054, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.251] GetClassNameW (in: hWnd=0x10054, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0108.251] GetWindowTextW (in: hWnd=0x2001a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0108.251] GetClassNameW (in: hWnd=0x2001a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0108.251] GetWindowTextW (in: hWnd=0x30028, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.251] GetClassNameW (in: hWnd=0x30028, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0108.251] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.251] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0108.251] GetWindowTextW (in: hWnd=0x1003a, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0108.251] GetClassNameW (in: hWnd=0x1003a, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0108.251] GetWindowTextW (in: hWnd=0x1002e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0108.251] GetClassNameW (in: hWnd=0x1002e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0108.252] GetWindowTextW (in: hWnd=0x10036, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="") returned 0 [0108.252] GetClassNameW (in: hWnd=0x10036, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0108.252] GetWindowTextW (in: hWnd=0x30026, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0108.252] GetClassNameW (in: hWnd=0x30026, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0108.252] GetWindowTextW (in: hWnd=0x100d0, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0108.252] GetClassNameW (in: hWnd=0x100d0, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0108.252] GetWindowTextW (in: hWnd=0x20020, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0108.252] GetClassNameW (in: hWnd=0x20020, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0108.252] GetWindowTextW (in: hWnd=0x20022, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.252] GetClassNameW (in: hWnd=0x20022, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.252] GetWindowTextW (in: hWnd=0x10116, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.252] GetClassNameW (in: hWnd=0x10116, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.252] GetWindowTextW (in: hWnd=0x2022e, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0108.252] GetClassNameW (in: hWnd=0x2022e, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0108.252] GetWindowTextW (in: hWnd=0x301f8, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.252] GetClassNameW (in: hWnd=0x301f8, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.252] GetWindowTextW (in: hWnd=0x20242, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.252] GetClassNameW (in: hWnd=0x20242, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.252] GetWindowTextW (in: hWnd=0x40204, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.252] GetClassNameW (in: hWnd=0x40204, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.252] GetWindowTextW (in: hWnd=0x20278, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.252] GetClassNameW (in: hWnd=0x20278, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.252] GetWindowTextW (in: hWnd=0x30200, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.252] GetClassNameW (in: hWnd=0x30200, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.252] GetWindowTextW (in: hWnd=0x201d2, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.252] GetClassNameW (in: hWnd=0x201d2, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.252] GetWindowTextW (in: hWnd=0x20182, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.252] GetClassNameW (in: hWnd=0x20182, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.253] GetWindowTextW (in: hWnd=0x20180, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.253] GetClassNameW (in: hWnd=0x20180, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.253] GetWindowTextW (in: hWnd=0x20170, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.253] GetClassNameW (in: hWnd=0x20170, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.253] GetWindowTextW (in: hWnd=0x2016c, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.253] GetClassNameW (in: hWnd=0x2016c, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.253] GetWindowTextW (in: hWnd=0x20168, lpString=0xbae3f8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.253] GetClassNameW (in: hWnd=0x20168, lpClassName=0xbae3f8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.253] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0108.253] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0108.253] CharUpperBuffW (in: lpsz="JISHSAQNRFCRNIRYGBOZ", cchLength=0x14 | out: lpsz="JISHSAQNRFCRNIRYGBOZ") returned 0x14 [0108.254] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0108.254] CharUpperBuffW (in: lpsz="VJDHTAEVXLIKKHTNXJOS", cchLength=0x14 | out: lpsz="VJDHTAEVXLIKKHTNXJOS") returned 0x14 [0108.254] CharUpperBuffW (in: lpsz="JHEUBZNWULMCVYSZIWHO", cchLength=0x14 | out: lpsz="JHEUBZNWULMCVYSZIWHO") returned 0x14 [0108.254] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0108.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0108.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x10241f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceW", lpUsedDefaultChar=0x0) returned 14 [0108.254] GetProcAddress (hModule=0x777b0000, lpProcName="FindResourceW") returned 0x777f3e61 [0108.255] FindResourceW (hModule=0x0, lpName="gwnxfbycxsvu", lpType=0xa) returned 0x4b74b8 [0108.255] FreeLibrary (hLibModule=0x777b0000) returned 1 [0108.255] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0108.255] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0108.256] CharUpperBuffW (in: lpsz="LZXDYKDLWYEUUZHLDWMY", cchLength=0x14 | out: lpsz="LZXDYKDLWYEUUZHLDWMY") returned 0x14 [0108.256] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0108.256] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0108.256] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0108.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0108.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x1023c58, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SizeofResource", lpUsedDefaultChar=0x0) returned 15 [0108.257] GetProcAddress (hModule=0x777b0000, lpProcName="SizeofResource") returned 0x777f3e7f [0108.257] SizeofResource (hModule=0x0, hResInfo=0x4b74b8) returned 0x13d984 [0108.257] FreeLibrary (hLibModule=0x777b0000) returned 1 [0108.257] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0108.257] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0108.257] CharUpperBuffW (in: lpsz="DCSTEJJRTZWI_QDXAZHL", cchLength=0x14 | out: lpsz="DCSTEJJRTZWI_QDXAZHL") returned 0x14 [0108.257] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0108.258] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0108.258] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0108.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0108.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x1023b38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoadResource", lpUsedDefaultChar=0x0) returned 13 [0108.258] GetProcAddress (hModule=0x777b0000, lpProcName="LoadResource") returned 0x777f984d [0108.258] LoadResource (hModule=0x0, hResInfo=0x4b74b8) returned 0x50fb1c [0108.258] FreeLibrary (hLibModule=0x777b0000) returned 1 [0108.258] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0108.259] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0108.259] CharUpperBuffW (in: lpsz="KAMA_G_MVOPZHGX_NHVN", cchLength=0x14 | out: lpsz="KAMA_G_MVOPZHGX_NHVN") returned 0x14 [0108.259] CharUpperBuffW (in: lpsz="DVKHCHQKYIBIZPGVY_ZU", cchLength=0x14 | out: lpsz="DVKHCHQKYIBIZPGVY_ZU") returned 0x14 [0108.259] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0108.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0108.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x1024540, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LockResource", lpUsedDefaultChar=0x0) returned 13 [0108.259] GetProcAddress (hModule=0x777b0000, lpProcName="LockResource") returned 0x777efd29 [0108.260] LockResource (hResData=0x50fb1c) returned 0x50fb1c [0108.260] FreeLibrary (hLibModule=0x777b0000) returned 1 [0108.260] CharUpperBuffW (in: lpsz="IQOZHBYWTDLIHUPBFBUV", cchLength=0x14 | out: lpsz="IQOZHBYWTDLIHUPBFBUV") returned 0x14 [0108.260] CharUpperBuffW (in: lpsz="RHHDPSHYSELIILBKVHRP", cchLength=0x14 | out: lpsz="RHHDPSHYSELIILBKVHRP") returned 0x14 [0108.260] CharUpperBuffW (in: lpsz="TZGAEZZKSKGTEHHMJXUY", cchLength=0x14 | out: lpsz="TZGAEZZKSKGTEHHMJXUY") returned 0x14 [0108.347] CharUpperBuffW (in: lpsz="MKDKEHQRCFIJOLOMLLIZ", cchLength=0x14 | out: lpsz="MKDKEHQRCFIJOLOMLLIZ") returned 0x14 [0108.347] CharUpperBuffW (in: lpsz="SCZBIMQEJYZOJTBWPVJI", cchLength=0x14 | out: lpsz="SCZBIMQEJYZOJTBWPVJI") returned 0x14 [0108.348] CharUpperBuffW (in: lpsz="NRCKUIFNZLYKTCMKBAKB", cchLength=0x14 | out: lpsz="NRCKUIFNZLYKTCMKBAKB") returned 0x14 [0108.348] CharUpperBuffW (in: lpsz="CUHEVSXEDUELZVLIEXJU", cchLength=0x14 | out: lpsz="CUHEVSXEDUELZVLIEXJU") returned 0x14 [0108.348] CreateFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Local\\Temp\\b106484eb915e4ad6df697dc1442cbff-EDITED.jpg" (normalized: "c:\\users\\jpenum\\appdata\\local\\temp\\b106484eb915e4ad6df697dc1442cbff-edited.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0108.349] CharUpperBuffW (in: lpsz="HMCGCYHBHXQQEYPKMLVI", cchLength=0x14 | out: lpsz="HMCGCYHBHXQQEYPKMLVI") returned 0x14 [0108.398] CloseHandle (hObject=0x118) returned 1 [0108.399] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", cchCount1=38, lpString2="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", cchCount2=38) returned 2 [0108.406] CharUpperBuffW (in: lpsz="VCIKFNQMTNFUTAZVGLPLO", cchLength=0x15 | out: lpsz="VCIKFNQMTNFUTAZVGLPLO") returned 0x15 [0108.407] CharUpperBuffW (in: lpsz="ZWVOLVHCXTTABYIH_QIK", cchLength=0x14 | out: lpsz="ZWVOLVHCXTTABYIH_QIK") returned 0x14 [0108.407] GetFileAttributesW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe")) returned 0x20 [0108.407] CharUpperBuffW (in: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK", cchLength=0x19 | out: lpsz="XLRDSFAPMBTNMKPSATTVQCDUK") returned 0x19 [0108.407] CharUpperBuffW (in: lpsz="ZWVOLVHCXTTABYIH_QIK", cchLength=0x14 | out: lpsz="ZWVOLVHCXTTABYIH_QIK") returned 0x14 [0108.422] CharUpperBuffW (in: lpsz="XLYILFCSTEHTHZTSADPJ", cchLength=0x14 | out: lpsz="XLYILFCSTEHTHZTSADPJ") returned 0x14 [0108.423] CharUpperBuffW (in: lpsz="EI_ZJHJHDGSHHFEYHFRX", cchLength=0x14 | out: lpsz="EI_ZJHJHDGSHHFEYHFRX") returned 0x14 [0108.423] CharUpperBuffW (in: lpsz="XPIXFQANNLYBPUUDUPSA", cchLength=0x14 | out: lpsz="XPIXFQANNLYBPUUDUPSA") returned 0x14 [0108.423] CharUpperBuffW (in: lpsz="EIIMACLZOHUJRVQLXKFG", cchLength=0x14 | out: lpsz="EIIMACLZOHUJRVQLXKFG") returned 0x14 [0108.423] CharUpperBuffW (in: lpsz="PCGUMOOKRJFEFCWHYTZZ", cchLength=0x14 | out: lpsz="PCGUMOOKRJFEFCWHYTZZ") returned 0x14 [0108.424] CharUpperBuffW (in: lpsz="BCENHIJFCTHZUGDYGRXX", cchLength=0x14 | out: lpsz="BCENHIJFCTHZUGDYGRXX") returned 0x14 [0108.424] CharUpperBuffW (in: lpsz="RMJFRZCNFYCWWOVLRTXJ", cchLength=0x14 | out: lpsz="RMJFRZCNFYCWWOVLRTXJ") returned 0x14 [0108.424] CharUpperBuffW (in: lpsz="RNUSKUYSEUUNMJEDIIAX", cchLength=0x14 | out: lpsz="RNUSKUYSEUUNMJEDIIAX") returned 0x14 [0108.424] CharUpperBuffW (in: lpsz="IHZGGHJPCWWMELTUIIXP", cchLength=0x14 | out: lpsz="IHZGGHJPCWWMELTUIIXP") returned 0x14 [0108.425] CharUpperBuffW (in: lpsz="PXZUWBABVSZWUCBZYBQX", cchLength=0x14 | out: lpsz="PXZUWBABVSZWUCBZYBQX") returned 0x14 [0108.425] GetWindowTextW (in: hWnd=0x10066, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.425] GetClassNameW (in: hWnd=0x10066, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.425] GetWindowTextW (in: hWnd=0x10064, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.425] GetClassNameW (in: hWnd=0x10064, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.425] GetWindowTextW (in: hWnd=0x10050, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.425] GetClassNameW (in: hWnd=0x10050, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.425] GetWindowTextW (in: hWnd=0x10078, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.425] GetClassNameW (in: hWnd=0x10078, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.425] GetWindowTextW (in: hWnd=0x1006e, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.425] GetClassNameW (in: hWnd=0x1006e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.425] GetWindowTextW (in: hWnd=0x1006c, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.425] GetClassNameW (in: hWnd=0x1006c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.425] GetWindowTextW (in: hWnd=0x10068, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.425] GetClassNameW (in: hWnd=0x10068, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.425] GetWindowTextW (in: hWnd=0x10048, lpString=0xbae748, nMaxCount=1024 | out: lpString="Start") returned 5 [0108.425] GetClassNameW (in: hWnd=0x10048, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0108.425] GetWindowTextW (in: hWnd=0x2001e, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.425] GetClassNameW (in: hWnd=0x2001e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0108.425] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0108.425] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0108.425] GetWindowTextW (in: hWnd=0x10114, lpString=0xbae748, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0108.425] GetClassNameW (in: hWnd=0x10114, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0108.426] GetWindowTextW (in: hWnd=0x100da, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x100da, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x100bc, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x100bc, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x10094, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x10094, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x50082, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x50082, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x1007a, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x1007a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0108.426] GetWindowTextW (in: hWnd=0x1008c, lpString=0xbae748, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0108.426] GetClassNameW (in: hWnd=0x1008c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0108.426] GetWindowTextW (in: hWnd=0x2022c, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x2022c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x301b8, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x301b8, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x3019a, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x3019a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x20228, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x20228, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x20238, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x20238, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x20234, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x20234, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.426] GetWindowTextW (in: hWnd=0x20220, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.426] GetClassNameW (in: hWnd=0x20220, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x2025c, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x2025c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x20266, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x20266, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x20268, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x20268, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x20246, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x20246, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x20254, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x20254, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x20250, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x2024a, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x2024a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x2024c, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x2024c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x2021e, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x2021e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x2020e, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x2020e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x20216, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.427] GetClassNameW (in: hWnd=0x20216, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.427] GetWindowTextW (in: hWnd=0x201f6, lpString=0xbae748, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0108.427] GetClassNameW (in: hWnd=0x201f6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0108.427] GetWindowTextW (in: hWnd=0x701ae, lpString=0xbae748, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0108.428] DefWindowProcW (hWnd=0x701ae, Msg=0xd, wParam=0x400, lParam=0xbae748) returned 0x9 [0108.428] GetClassNameW (in: hWnd=0x701ae, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0108.428] GetWindowTextW (in: hWnd=0x300e6, lpString=0xbae748, nMaxCount=1024 | out: lpString="TaskEng - Task Scheduler Engine Process") returned 39 [0108.428] GetClassNameW (in: hWnd=0x300e6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0108.428] GetWindowTextW (in: hWnd=0x30282, lpString=0xbae748, nMaxCount=1024 | out: lpString=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0108.428] GetClassNameW (in: hWnd=0x30282, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0108.428] GetWindowTextW (in: hWnd=0x20286, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.428] GetClassNameW (in: hWnd=0x20286, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.428] GetWindowTextW (in: hWnd=0x30130, lpString=0xbae748, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0108.428] GetClassNameW (in: hWnd=0x30130, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0108.428] GetWindowTextW (in: hWnd=0x20198, lpString=0xbae748, nMaxCount=1024 | out: lpString="Oil") returned 3 [0108.428] GetClassNameW (in: hWnd=0x20198, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0108.428] GetWindowTextW (in: hWnd=0x20178, lpString=0xbae748, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0108.428] GetClassNameW (in: hWnd=0x20178, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0108.428] GetWindowTextW (in: hWnd=0x20176, lpString=0xbae748, nMaxCount=1024 | out: lpString="Runner") returned 6 [0108.428] GetClassNameW (in: hWnd=0x20176, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0108.428] GetWindowTextW (in: hWnd=0x2016e, lpString=0xbae748, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0108.428] GetClassNameW (in: hWnd=0x2016e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0108.428] GetWindowTextW (in: hWnd=0x2016a, lpString=0xbae748, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0108.429] GetClassNameW (in: hWnd=0x2016a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0108.429] GetWindowTextW (in: hWnd=0x3019e, lpString=0xbae748, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0108.429] GetClassNameW (in: hWnd=0x3019e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0108.429] GetWindowTextW (in: hWnd=0x30188, lpString=0xbae748, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0108.429] GetClassNameW (in: hWnd=0x30188, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0108.429] GetWindowTextW (in: hWnd=0x20164, lpString=0xbae748, nMaxCount=1024 | out: lpString="Charging") returned 8 [0108.429] GetClassNameW (in: hWnd=0x20164, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0108.429] GetWindowTextW (in: hWnd=0x20160, lpString=0xbae748, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0108.429] GetClassNameW (in: hWnd=0x20160, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0108.429] GetWindowTextW (in: hWnd=0x2015c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0108.429] GetClassNameW (in: hWnd=0x2015c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0108.429] GetWindowTextW (in: hWnd=0x20158, lpString=0xbae748, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0108.429] GetClassNameW (in: hWnd=0x20158, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0108.429] GetWindowTextW (in: hWnd=0x40152, lpString=0xbae748, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0108.429] GetClassNameW (in: hWnd=0x40152, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0108.429] GetWindowTextW (in: hWnd=0xd013a, lpString=0xbae748, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0108.429] GetClassNameW (in: hWnd=0xd013a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0108.429] GetWindowTextW (in: hWnd=0x301bc, lpString=0xbae748, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0108.429] GetClassNameW (in: hWnd=0x301bc, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0108.429] GetWindowTextW (in: hWnd=0x300dc, lpString=0xbae748, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0108.429] GetClassNameW (in: hWnd=0x300dc, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0108.429] GetWindowTextW (in: hWnd=0x30174, lpString=0xbae748, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0108.429] GetClassNameW (in: hWnd=0x30174, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0108.429] GetWindowTextW (in: hWnd=0x20148, lpString=0xbae748, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0108.429] GetClassNameW (in: hWnd=0x20148, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0108.429] GetWindowTextW (in: hWnd=0x20142, lpString=0xbae748, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0108.429] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0108.429] GetWindowTextW (in: hWnd=0x30144, lpString=0xbae748, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0108.430] GetClassNameW (in: hWnd=0x30144, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0108.430] GetWindowTextW (in: hWnd=0x901b0, lpString=0xbae748, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0108.430] GetClassNameW (in: hWnd=0x901b0, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0108.430] GetWindowTextW (in: hWnd=0x501a4, lpString=0xbae748, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0108.430] GetClassNameW (in: hWnd=0x501a4, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0108.430] GetWindowTextW (in: hWnd=0x201a8, lpString=0xbae748, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0108.430] GetClassNameW (in: hWnd=0x201a8, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0108.430] GetWindowTextW (in: hWnd=0x2014e, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.430] GetClassNameW (in: hWnd=0x2014e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0108.430] GetWindowTextW (in: hWnd=0x101be, lpString=0xbae748, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0108.430] GetClassNameW (in: hWnd=0x101be, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0108.430] GetWindowTextW (in: hWnd=0x4013c, lpString=0xbae748, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0108.430] GetClassNameW (in: hWnd=0x4013c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0108.430] GetWindowTextW (in: hWnd=0x10128, lpString=0xbae748, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0108.430] GetClassNameW (in: hWnd=0x10128, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0108.430] GetWindowTextW (in: hWnd=0x20126, lpString=0xbae748, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0108.430] GetClassNameW (in: hWnd=0x20126, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0108.430] GetWindowTextW (in: hWnd=0x2011a, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.430] GetClassNameW (in: hWnd=0x2011a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0108.430] GetWindowTextW (in: hWnd=0x1010a, lpString=0xbae748, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0108.430] GetClassNameW (in: hWnd=0x1010a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0108.430] GetWindowTextW (in: hWnd=0x10102, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.430] GetClassNameW (in: hWnd=0x10102, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0108.430] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbae748, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0108.430] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0108.430] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.430] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.430] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.431] GetWindowTextW (in: hWnd=0x20034, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x20034, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.431] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.431] GetWindowTextW (in: hWnd=0x100c2, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x100c2, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0108.431] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0108.431] GetWindowTextW (in: hWnd=0x100ac, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x100ac, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.431] GetWindowTextW (in: hWnd=0x100a6, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x100a6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.431] GetWindowTextW (in: hWnd=0x200a0, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x200a0, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.431] GetWindowTextW (in: hWnd=0x10086, lpString=0xbae748, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0108.431] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0108.431] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0108.431] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0108.431] GetWindowTextW (in: hWnd=0x40024, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x40024, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.431] GetWindowTextW (in: hWnd=0x10072, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x10072, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.431] GetWindowTextW (in: hWnd=0x1006a, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x1006a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.431] GetWindowTextW (in: hWnd=0x10058, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.431] GetClassNameW (in: hWnd=0x10058, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.431] GetWindowTextW (in: hWnd=0x100e2, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.432] GetClassNameW (in: hWnd=0x100e2, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.432] GetWindowTextW (in: hWnd=0x10054, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.432] GetClassNameW (in: hWnd=0x10054, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0108.432] GetWindowTextW (in: hWnd=0x2001a, lpString=0xbae748, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0108.432] GetClassNameW (in: hWnd=0x2001a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0108.432] GetWindowTextW (in: hWnd=0x30028, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.432] GetClassNameW (in: hWnd=0x30028, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0108.432] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.432] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0108.432] GetWindowTextW (in: hWnd=0x1003a, lpString=0xbae748, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0108.432] GetClassNameW (in: hWnd=0x1003a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0108.432] GetWindowTextW (in: hWnd=0x1002e, lpString=0xbae748, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0108.432] GetClassNameW (in: hWnd=0x1002e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0108.432] GetWindowTextW (in: hWnd=0x10036, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.432] GetClassNameW (in: hWnd=0x10036, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0108.432] GetWindowTextW (in: hWnd=0x30026, lpString=0xbae748, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0108.432] GetClassNameW (in: hWnd=0x30026, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0108.432] GetWindowTextW (in: hWnd=0x100d0, lpString=0xbae748, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0108.432] GetClassNameW (in: hWnd=0x100d0, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0108.432] GetWindowTextW (in: hWnd=0x20020, lpString=0xbae748, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0108.432] GetClassNameW (in: hWnd=0x20020, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0108.432] GetWindowTextW (in: hWnd=0x20022, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.432] GetClassNameW (in: hWnd=0x20022, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.432] GetWindowTextW (in: hWnd=0x10116, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.432] GetClassNameW (in: hWnd=0x10116, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.432] GetWindowTextW (in: hWnd=0x2022e, lpString=0xbae748, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0108.432] GetClassNameW (in: hWnd=0x2022e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0108.432] GetWindowTextW (in: hWnd=0x301f8, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.432] GetClassNameW (in: hWnd=0x301f8, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x20242, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x20242, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x40204, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x40204, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x20278, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x20278, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x30200, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x30200, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x201d2, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x201d2, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x20182, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x20182, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x20180, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x20180, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x20170, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x20170, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x2016c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x2016c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x20168, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x20168, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x3019c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x3019c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x20166, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x20166, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x20162, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x20162, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.433] GetWindowTextW (in: hWnd=0x2015e, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.433] GetClassNameW (in: hWnd=0x2015e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x2015a, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x2015a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x20156, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x20156, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x40150, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x40150, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x201ba, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x201ba, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x20172, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x20172, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x4010e, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x4010e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x2014a, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x2014a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x20146, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x20146, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x30140, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x30140, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x20154, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x20154, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x101c0, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x101c0, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x1010c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x1010c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x10104, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.434] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.434] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.435] GetWindowTextW (in: hWnd=0x1003c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.435] GetClassNameW (in: hWnd=0x1003c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.435] GetWindowTextW (in: hWnd=0x10030, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.435] GetClassNameW (in: hWnd=0x10030, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.435] GetWindowTextW (in: hWnd=0x10038, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.435] GetClassNameW (in: hWnd=0x10038, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.435] GetWindowTextW (in: hWnd=0x100ec, lpString=0xbae748, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0108.435] GetClassNameW (in: hWnd=0x100ec, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0108.435] GetWindowTextW (in: hWnd=0x2002a, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.435] GetClassNameW (in: hWnd=0x2002a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.435] CharUpperBuffW (in: lpsz="ZEFFQFJWNEFHGNVZTAMA", cchLength=0x14 | out: lpsz="ZEFFQFJWNEFHGNVZTAMA") returned 0x14 [0108.435] CharUpperBuffW (in: lpsz="QBXIUDLNKEXQURPGRICK", cchLength=0x14 | out: lpsz="QBXIUDLNKEXQURPGRICK") returned 0x14 [0108.435] CharUpperBuffW (in: lpsz="WQWHHTKNXZNMLDWTQSVG", cchLength=0x14 | out: lpsz="WQWHHTKNXZNMLDWTQSVG") returned 0x14 [0108.436] CharUpperBuffW (in: lpsz="XJSETJNZVIBNFLHXZOUG", cchLength=0x14 | out: lpsz="XJSETJNZVIBNFLHXZOUG") returned 0x14 [0108.436] CharUpperBuffW (in: lpsz="YVWBREMSKTIATHZZAWPW", cchLength=0x14 | out: lpsz="YVWBREMSKTIATHZZAWPW") returned 0x14 [0108.436] CharUpperBuffW (in: lpsz="FZUFBWLRBOPBUUHPJQTM", cchLength=0x14 | out: lpsz="FZUFBWLRBOPBUUHPJQTM") returned 0x14 [0108.437] CharUpperBuffW (in: lpsz="RFPNQVGXPSVABCODQHCB", cchLength=0x14 | out: lpsz="RFPNQVGXPSVABCODQHCB") returned 0x14 [0108.437] CharUpperBuffW (in: lpsz="NWYSKVLJAUVPLQDLFIVF", cchLength=0x14 | out: lpsz="NWYSKVLJAUVPLQDLFIVF") returned 0x14 [0108.437] CharUpperBuffW (in: lpsz="ZOBCVWKGIFEMUHGZK_YF", cchLength=0x14 | out: lpsz="ZOBCVWKGIFEMUHGZK_YF") returned 0x14 [0108.437] CharUpperBuffW (in: lpsz="MVIHOZMJVDIPREFGIHCC", cchLength=0x14 | out: lpsz="MVIHOZMJVDIPREFGIHCC") returned 0x14 [0108.437] CharUpperBuffW (in: lpsz="JRU_GOTBXQVDMXCISXWA", cchLength=0x14 | out: lpsz="JRU_GOTBXQVDMXCISXWA") returned 0x14 [0108.438] CharUpperBuffW (in: lpsz="PKBZQYQSOVJJWCIRGB_I", cchLength=0x14 | out: lpsz="PKBZQYQSOVJJWCIRGB_I") returned 0x14 [0108.438] CharUpperBuffW (in: lpsz="BICLVWXMDOUIQZWAPWP_", cchLength=0x14 | out: lpsz="BICLVWXMDOUIQZWAPWP_") returned 0x14 [0108.438] CharUpperBuffW (in: lpsz="NGOVNEWDKTABMVPOPHOQ", cchLength=0x14 | out: lpsz="NGOVNEWDKTABMVPOPHOQ") returned 0x14 [0108.438] CharUpperBuffW (in: lpsz="MQ_DIPASCWMFVPEARFNV", cchLength=0x14 | out: lpsz="MQ_DIPASCWMFVPEARFNV") returned 0x14 [0108.439] CharUpperBuffW (in: lpsz="EV_EDZYHSKAEVNLOCCMD", cchLength=0x14 | out: lpsz="EV_EDZYHSKAEVNLOCCMD") returned 0x14 [0108.439] GetWindowTextW (in: hWnd=0x10066, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.439] GetClassNameW (in: hWnd=0x10066, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.439] GetWindowTextW (in: hWnd=0x10064, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.439] GetClassNameW (in: hWnd=0x10064, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.439] GetWindowTextW (in: hWnd=0x10050, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.439] GetClassNameW (in: hWnd=0x10050, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.439] GetWindowTextW (in: hWnd=0x10078, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.439] GetClassNameW (in: hWnd=0x10078, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.439] GetWindowTextW (in: hWnd=0x1006e, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.439] GetClassNameW (in: hWnd=0x1006e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.439] GetWindowTextW (in: hWnd=0x1006c, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.439] GetClassNameW (in: hWnd=0x1006c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.439] GetWindowTextW (in: hWnd=0x10068, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.439] GetClassNameW (in: hWnd=0x10068, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.439] GetWindowTextW (in: hWnd=0x10048, lpString=0xbae748, nMaxCount=1024 | out: lpString="Start") returned 5 [0108.439] GetClassNameW (in: hWnd=0x10048, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0108.439] GetWindowTextW (in: hWnd=0x2001e, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x2001e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0108.440] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0108.440] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0108.440] GetWindowTextW (in: hWnd=0x10114, lpString=0xbae748, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0108.440] GetClassNameW (in: hWnd=0x10114, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0108.440] GetWindowTextW (in: hWnd=0x100da, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x100da, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.440] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.440] GetWindowTextW (in: hWnd=0x100bc, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x100bc, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.440] GetWindowTextW (in: hWnd=0x10094, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x10094, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.440] GetWindowTextW (in: hWnd=0x50082, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x50082, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.440] GetWindowTextW (in: hWnd=0x1007a, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x1007a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0108.440] GetWindowTextW (in: hWnd=0x1008c, lpString=0xbae748, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0108.440] GetClassNameW (in: hWnd=0x1008c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0108.440] GetWindowTextW (in: hWnd=0x2022c, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x2022c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.440] GetWindowTextW (in: hWnd=0x301b8, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x301b8, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.440] GetWindowTextW (in: hWnd=0x3019a, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x3019a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.440] GetWindowTextW (in: hWnd=0x20228, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.440] GetClassNameW (in: hWnd=0x20228, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.440] GetWindowTextW (in: hWnd=0x20238, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x20238, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x20234, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x20234, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x20220, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x20220, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x2025c, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x2025c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x20266, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x20266, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x20268, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x20268, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x20246, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x20246, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x20254, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x20254, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x20250, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x2024a, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x2024a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x2024c, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x2024c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x2021e, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x2021e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x2020e, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x2020e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x20216, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.441] GetClassNameW (in: hWnd=0x20216, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.441] GetWindowTextW (in: hWnd=0x201f6, lpString=0xbae748, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0108.441] GetClassNameW (in: hWnd=0x201f6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0108.442] GetWindowTextW (in: hWnd=0x701ae, lpString=0xbae748, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0108.442] DefWindowProcW (hWnd=0x701ae, Msg=0xd, wParam=0x400, lParam=0xbae748) returned 0x9 [0108.442] GetClassNameW (in: hWnd=0x701ae, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0108.442] GetWindowTextW (in: hWnd=0x300e6, lpString=0xbae748, nMaxCount=1024 | out: lpString="TaskEng - Task Scheduler Engine Process") returned 39 [0108.442] GetClassNameW (in: hWnd=0x300e6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0108.442] GetWindowTextW (in: hWnd=0x30282, lpString=0xbae748, nMaxCount=1024 | out: lpString=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0108.442] GetClassNameW (in: hWnd=0x30282, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0108.442] GetWindowTextW (in: hWnd=0x20286, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.442] GetClassNameW (in: hWnd=0x20286, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.442] GetWindowTextW (in: hWnd=0x30130, lpString=0xbae748, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0108.442] GetClassNameW (in: hWnd=0x30130, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0108.442] GetWindowTextW (in: hWnd=0x20198, lpString=0xbae748, nMaxCount=1024 | out: lpString="Oil") returned 3 [0108.442] GetClassNameW (in: hWnd=0x20198, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0108.442] GetWindowTextW (in: hWnd=0x20178, lpString=0xbae748, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0108.442] GetClassNameW (in: hWnd=0x20178, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0108.442] GetWindowTextW (in: hWnd=0x20176, lpString=0xbae748, nMaxCount=1024 | out: lpString="Runner") returned 6 [0108.442] GetClassNameW (in: hWnd=0x20176, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0108.442] GetWindowTextW (in: hWnd=0x2016e, lpString=0xbae748, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0108.442] GetClassNameW (in: hWnd=0x2016e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0108.442] GetWindowTextW (in: hWnd=0x2016a, lpString=0xbae748, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0108.442] GetClassNameW (in: hWnd=0x2016a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0108.442] GetWindowTextW (in: hWnd=0x3019e, lpString=0xbae748, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0108.442] GetClassNameW (in: hWnd=0x3019e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0108.442] GetWindowTextW (in: hWnd=0x30188, lpString=0xbae748, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0108.442] GetClassNameW (in: hWnd=0x30188, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0108.442] GetWindowTextW (in: hWnd=0x20164, lpString=0xbae748, nMaxCount=1024 | out: lpString="Charging") returned 8 [0108.442] GetClassNameW (in: hWnd=0x20164, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0108.442] GetWindowTextW (in: hWnd=0x20160, lpString=0xbae748, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0108.443] GetClassNameW (in: hWnd=0x20160, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0108.443] GetWindowTextW (in: hWnd=0x2015c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0108.443] GetClassNameW (in: hWnd=0x2015c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0108.443] GetWindowTextW (in: hWnd=0x20158, lpString=0xbae748, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0108.443] GetClassNameW (in: hWnd=0x20158, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0108.443] GetWindowTextW (in: hWnd=0x40152, lpString=0xbae748, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0108.443] GetClassNameW (in: hWnd=0x40152, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0108.443] GetWindowTextW (in: hWnd=0xd013a, lpString=0xbae748, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0108.443] GetClassNameW (in: hWnd=0xd013a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0108.443] GetWindowTextW (in: hWnd=0x301bc, lpString=0xbae748, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0108.443] GetClassNameW (in: hWnd=0x301bc, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0108.443] GetWindowTextW (in: hWnd=0x300dc, lpString=0xbae748, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0108.443] GetClassNameW (in: hWnd=0x300dc, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0108.443] GetWindowTextW (in: hWnd=0x30174, lpString=0xbae748, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0108.443] GetClassNameW (in: hWnd=0x30174, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0108.443] GetWindowTextW (in: hWnd=0x20148, lpString=0xbae748, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0108.443] GetClassNameW (in: hWnd=0x20148, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0108.443] GetWindowTextW (in: hWnd=0x20142, lpString=0xbae748, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0108.443] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0108.443] GetWindowTextW (in: hWnd=0x30144, lpString=0xbae748, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0108.443] GetClassNameW (in: hWnd=0x30144, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0108.443] GetWindowTextW (in: hWnd=0x901b0, lpString=0xbae748, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0108.443] GetClassNameW (in: hWnd=0x901b0, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0108.443] GetWindowTextW (in: hWnd=0x501a4, lpString=0xbae748, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0108.443] GetClassNameW (in: hWnd=0x501a4, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0108.443] GetWindowTextW (in: hWnd=0x201a8, lpString=0xbae748, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0108.443] GetClassNameW (in: hWnd=0x201a8, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0108.444] GetWindowTextW (in: hWnd=0x2014e, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.444] GetClassNameW (in: hWnd=0x2014e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0108.444] GetWindowTextW (in: hWnd=0x101be, lpString=0xbae748, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0108.444] GetClassNameW (in: hWnd=0x101be, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0108.444] GetWindowTextW (in: hWnd=0x4013c, lpString=0xbae748, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0108.444] GetClassNameW (in: hWnd=0x4013c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0108.444] GetWindowTextW (in: hWnd=0x10128, lpString=0xbae748, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0108.444] GetClassNameW (in: hWnd=0x10128, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0108.444] GetWindowTextW (in: hWnd=0x20126, lpString=0xbae748, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0108.444] GetClassNameW (in: hWnd=0x20126, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0108.444] GetWindowTextW (in: hWnd=0x2011a, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.444] GetClassNameW (in: hWnd=0x2011a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0108.444] GetWindowTextW (in: hWnd=0x1010a, lpString=0xbae748, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0108.444] GetClassNameW (in: hWnd=0x1010a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0108.444] GetWindowTextW (in: hWnd=0x10102, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.444] GetClassNameW (in: hWnd=0x10102, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0108.444] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbae748, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0108.444] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0108.444] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.444] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.444] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.444] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.444] GetWindowTextW (in: hWnd=0x20034, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.444] GetClassNameW (in: hWnd=0x20034, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.444] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.444] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.444] GetWindowTextW (in: hWnd=0x100c2, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.444] GetClassNameW (in: hWnd=0x100c2, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0108.445] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0108.445] GetWindowTextW (in: hWnd=0x100ac, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x100ac, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.445] GetWindowTextW (in: hWnd=0x100a6, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x100a6, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.445] GetWindowTextW (in: hWnd=0x200a0, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x200a0, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.445] GetWindowTextW (in: hWnd=0x10086, lpString=0xbae748, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0108.445] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0108.445] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0108.445] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0108.445] GetWindowTextW (in: hWnd=0x40024, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x40024, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.445] GetWindowTextW (in: hWnd=0x10072, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x10072, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.445] GetWindowTextW (in: hWnd=0x1006a, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x1006a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.445] GetWindowTextW (in: hWnd=0x10058, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x10058, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0108.445] GetWindowTextW (in: hWnd=0x100e2, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x100e2, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0108.445] GetWindowTextW (in: hWnd=0x10054, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x10054, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0108.445] GetWindowTextW (in: hWnd=0x2001a, lpString=0xbae748, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0108.445] GetClassNameW (in: hWnd=0x2001a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0108.445] GetWindowTextW (in: hWnd=0x30028, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.445] GetClassNameW (in: hWnd=0x30028, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0108.446] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.446] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0108.446] GetWindowTextW (in: hWnd=0x1003a, lpString=0xbae748, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0108.446] GetClassNameW (in: hWnd=0x1003a, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0108.446] GetWindowTextW (in: hWnd=0x1002e, lpString=0xbae748, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0108.446] GetClassNameW (in: hWnd=0x1002e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0108.446] GetWindowTextW (in: hWnd=0x10036, lpString=0xbae748, nMaxCount=1024 | out: lpString="") returned 0 [0108.446] GetClassNameW (in: hWnd=0x10036, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0108.446] GetWindowTextW (in: hWnd=0x30026, lpString=0xbae748, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0108.446] GetClassNameW (in: hWnd=0x30026, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0108.446] GetWindowTextW (in: hWnd=0x100d0, lpString=0xbae748, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0108.446] GetClassNameW (in: hWnd=0x100d0, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0108.446] GetWindowTextW (in: hWnd=0x20020, lpString=0xbae748, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0108.446] GetClassNameW (in: hWnd=0x20020, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0108.446] GetWindowTextW (in: hWnd=0x20022, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.446] GetClassNameW (in: hWnd=0x20022, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.446] GetWindowTextW (in: hWnd=0x10116, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.446] GetClassNameW (in: hWnd=0x10116, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.446] GetWindowTextW (in: hWnd=0x2022e, lpString=0xbae748, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0108.446] GetClassNameW (in: hWnd=0x2022e, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0108.446] GetWindowTextW (in: hWnd=0x301f8, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.446] GetClassNameW (in: hWnd=0x301f8, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.446] GetWindowTextW (in: hWnd=0x20242, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.446] GetClassNameW (in: hWnd=0x20242, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.446] GetWindowTextW (in: hWnd=0x40204, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.446] GetClassNameW (in: hWnd=0x40204, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.446] GetWindowTextW (in: hWnd=0x20278, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.446] GetClassNameW (in: hWnd=0x20278, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.447] GetWindowTextW (in: hWnd=0x30200, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.447] GetClassNameW (in: hWnd=0x30200, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.447] GetWindowTextW (in: hWnd=0x201d2, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.447] GetClassNameW (in: hWnd=0x201d2, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.447] GetWindowTextW (in: hWnd=0x20182, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.447] GetClassNameW (in: hWnd=0x20182, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.447] GetWindowTextW (in: hWnd=0x20180, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.447] GetClassNameW (in: hWnd=0x20180, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.447] GetWindowTextW (in: hWnd=0x20170, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.447] GetClassNameW (in: hWnd=0x20170, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.447] GetWindowTextW (in: hWnd=0x2016c, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.447] GetClassNameW (in: hWnd=0x2016c, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.447] GetWindowTextW (in: hWnd=0x20168, lpString=0xbae748, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0108.447] GetClassNameW (in: hWnd=0x20168, lpClassName=0xbae748, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0108.447] CharUpperBuffW (in: lpsz="HTWRVULEKT_VERDGTRWH", cchLength=0x14 | out: lpsz="HTWRVULEKT_VERDGTRWH") returned 0x14 [0108.448] CharUpperBuffW (in: lpsz="LYYDRFOIXUMXJVQVLAHV", cchLength=0x14 | out: lpsz="LYYDRFOIXUMXJVQVLAHV") returned 0x14 [0108.448] CharUpperBuffW (in: lpsz="TVYEHKDCOSIGLZCIVOQW", cchLength=0x14 | out: lpsz="TVYEHKDCOSIGLZCIVOQW") returned 0x14 [0108.448] CharUpperBuffW (in: lpsz="HOGZIXMXCNXYPWYGIGCP", cchLength=0x14 | out: lpsz="HOGZIXMXCNXYPWYGIGCP") returned 0x14 [0108.448] CharUpperBuffW (in: lpsz="KZWKYZWVIRRIVMZBYXSW", cchLength=0x14 | out: lpsz="KZWKYZWVIRRIVMZBYXSW") returned 0x14 [0108.449] CharUpperBuffW (in: lpsz="ECIEUQIYMORRJKVXPJYB", cchLength=0x14 | out: lpsz="ECIEUQIYMORRJKVXPJYB") returned 0x14 [0108.449] CharUpperBuffW (in: lpsz="OBTNOAZZXFULCMTMDWVU", cchLength=0x14 | out: lpsz="OBTNOAZZXFULCMTMDWVU") returned 0x14 [0108.449] CharUpperBuffW (in: lpsz="OVZCBZ_ZLJOLCXZNJUAW", cchLength=0x14 | out: lpsz="OVZCBZ_ZLJOLCXZNJUAW") returned 0x14 [0108.450] CharUpperBuffW (in: lpsz="YAMNUZUSFDKZQATHZZSQ", cchLength=0x14 | out: lpsz="YAMNUZUSFDKZQATHZZSQ") returned 0x14 [0108.450] CharUpperBuffW (in: lpsz="LQUJGTPA_PUCQRQEZQFH", cchLength=0x14 | out: lpsz="LQUJGTPA_PUCQRQEZQFH") returned 0x14 [0108.450] CharUpperBuffW (in: lpsz="QIEAJZQSPPEKWQMBLGHC", cchLength=0x14 | out: lpsz="QIEAJZQSPPEKWQMBLGHC") returned 0x14 [0108.451] CharUpperBuffW (in: lpsz="MLFUNICGBIPLKOZZMRLD", cchLength=0x14 | out: lpsz="MLFUNICGBIPLKOZZMRLD") returned 0x14 [0108.451] CharUpperBuffW (in: lpsz="IQINDKZDOBQHATSHIFSD", cchLength=0x14 | out: lpsz="IQINDKZDOBQHATSHIFSD") returned 0x14 [0108.451] CharUpperBuffW (in: lpsz="XUBBQHPLBBZYWTXMJXUT", cchLength=0x14 | out: lpsz="XUBBQHPLBBZYWTXMJXUT") returned 0x14 [0108.451] CharUpperBuffW (in: lpsz="SLUBUVNKCZVYRBQSJICA", cchLength=0x14 | out: lpsz="SLUBUVNKCZVYRBQSJICA") returned 0x14 [0108.452] CharUpperBuffW (in: lpsz="VFFBUHEXEVO_RBQB_XAI", cchLength=0x14 | out: lpsz="VFFBUHEXEVO_RBQB_XAI") returned 0x14 [0108.452] CharUpperBuffW (in: lpsz="CJJOMNXLLWQZOOHCGPPV", cchLength=0x14 | out: lpsz="CJJOMNXLLWQZOOHCGPPV") returned 0x14 [0108.452] CharUpperBuffW (in: lpsz="OJJUCOOVWBYRNRBQDNXP", cchLength=0x14 | out: lpsz="OJJUCOOVWBYRNRBQDNXP") returned 0x14 [0108.453] CharUpperBuffW (in: lpsz="XCIRFXXXJHSDXJWXLYRP", cchLength=0x14 | out: lpsz="XCIRFXXXJHSDXJWXLYRP") returned 0x14 [0108.453] CharUpperBuffW (in: lpsz="SHRDUDUXIBSFRSOHBKUB", cchLength=0x14 | out: lpsz="SHRDUDUXIBSFRSOHBKUB") returned 0x14 [0108.453] CharUpperBuffW (in: lpsz="YPVWVILATENQPHHKEPHT", cchLength=0x14 | out: lpsz="YPVWVILATENQPHHKEPHT") returned 0x14 [0108.453] CharUpperBuffW (in: lpsz="GPBLKVUOPSITYTGEOEWR", cchLength=0x14 | out: lpsz="GPBLKVUOPSITYTGEOEWR") returned 0x14 [0108.454] CharUpperBuffW (in: lpsz="XIPRDMOUHM_SC_XVNZUP", cchLength=0x14 | out: lpsz="XIPRDMOUHM_SC_XVNZUP") returned 0x14 [0108.454] CharUpperBuffW (in: lpsz="OXVZEGLHKYKLXNTCCQTR", cchLength=0x14 | out: lpsz="OXVZEGLHKYKLXNTCCQTR") returned 0x14 [0108.454] CharUpperBuffW (in: lpsz="GBJ_DQSWHJJWDUBFYXFM", cchLength=0x14 | out: lpsz="GBJ_DQSWHJJWDUBFYXFM") returned 0x14 [0108.454] CharUpperBuffW (in: lpsz="YSFEKSHBWYKZXZYPGXNE", cchLength=0x14 | out: lpsz="YSFEKSHBWYKZXZYPGXNE") returned 0x14 [0108.455] CharUpperBuffW (in: lpsz="ETZBKDOWNNIQP_ITLSAP", cchLength=0x14 | out: lpsz="ETZBKDOWNNIQP_ITLSAP") returned 0x14 [0108.455] CharUpperBuffW (in: lpsz="IABFGAPKIGYAYSJNNSGO", cchLength=0x14 | out: lpsz="IABFGAPKIGYAYSJNNSGO") returned 0x14 [0108.455] CharUpperBuffW (in: lpsz="JLAZCEZFXQDDOTTRW_FD", cchLength=0x14 | out: lpsz="JLAZCEZFXQDDOTTRW_FD") returned 0x14 [0108.455] CharUpperBuffW (in: lpsz="RKIBCUCBZOMNBTIBKLSI", cchLength=0x14 | out: lpsz="RKIBCUCBZOMNBTIBKLSI") returned 0x14 [0108.456] CharUpperBuffW (in: lpsz="BKJKCOXXKWHEFNRWBBRK", cchLength=0x14 | out: lpsz="BKJKCOXXKWHEFNRWBBRK") returned 0x14 [0108.577] LoadLibraryW (lpLibFileName="kernel32") returned 0x777b0000 [0108.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAlloc", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0108.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAlloc", cchWideChar=13, lpMultiByteStr=0x1024240, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAlloc", lpUsedDefaultChar=0x0) returned 13 [0108.602] GetProcAddress (hModule=0x777b0000, lpProcName="VirtualAlloc") returned 0x77802fb6 [0108.602] VirtualAlloc (lpAddress=0x0, dwSize=0x5c2, flAllocationType=0x3000, flProtect=0x40) returned 0x100000 [0109.063] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xbaeb10*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbaec0c | out: lpCommandLine="", lpProcessInformation=0xbaec0c*(hProcess=0x128, hThread=0x118, dwProcessId=0xb18, dwThreadId=0xaf4)) returned 1 [0109.067] GetThreadContext (in: hThread=0x118, lpContext=0xbae844 | out: lpContext=0xbae844*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x3b, SegEs=0x23, SegDs=0x23, Edi=0x0, Esi=0x0, Ebx=0x7ffd9000, Edx=0x0, Ecx=0x0, Eax=0xf7b7de, Ebp=0x0, Eip=0x77927098, SegCs=0x1b, EFlags=0x200, Esp=0x22fa04, SegSs=0x23, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0109.067] ReadProcessMemory (in: hProcess=0x128, lpBaseAddress=0x7ffd9008, lpBuffer=0xbaebf0, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xbaebf0*, lpNumberOfBytesRead=0x0) returned 1 [0109.067] VirtualAlloc (lpAddress=0x0, dwSize=0x56000, flAllocationType=0x3000, flProtect=0x40) returned 0x20d0000 [0109.067] VirtualAllocEx (hProcess=0x128, lpAddress=0x400000, dwSize=0x56000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0109.071] WriteProcessMemory (in: hProcess=0x128, lpBaseAddress=0x400000, lpBuffer=0x20d0000*, nSize=0x56000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x20d0000*, lpNumberOfBytesWritten=0x0) returned 1 [0109.080] VirtualProtectEx (in: hProcess=0x128, lpAddress=0x400000, dwSize=0x200, flNewProtect=0x2, lpflOldProtect=0xbaebd0 | out: lpflOldProtect=0xbaebd0*=0x40) returned 1 [0109.080] VirtualProtectEx (in: hProcess=0x128, lpAddress=0x402000, dwSize=0x4fd24, flNewProtect=0x20, lpflOldProtect=0xbaebd0 | out: lpflOldProtect=0xbaebd0*=0x40) returned 1 [0109.081] VirtualProtectEx (in: hProcess=0x128, lpAddress=0x452000, dwSize=0x2d0, flNewProtect=0x2, lpflOldProtect=0xbaebd0 | out: lpflOldProtect=0xbaebd0*=0x40) returned 1 [0109.081] VirtualProtectEx (in: hProcess=0x128, lpAddress=0x454000, dwSize=0xc, flNewProtect=0x2, lpflOldProtect=0xbaebd0 | out: lpflOldProtect=0xbaebd0*=0x40) returned 1 [0109.081] VirtualFree (lpAddress=0x20d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.083] WriteProcessMemory (in: hProcess=0x128, lpBaseAddress=0x7ffd9008, lpBuffer=0xbaec2c*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0xbaec2c*, lpNumberOfBytesWritten=0x0) returned 1 [0109.084] SetThreadContext (hThread=0x118, lpContext=0xbae844*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x3b, SegEs=0x23, SegDs=0x23, Edi=0x0, Esi=0x0, Ebx=0x7ffd9000, Edx=0x0, Ecx=0x0, Eax=0x451d1e, Ebp=0x0, Eip=0x77927098, SegCs=0x1b, EFlags=0x200, Esp=0x22fa04, SegSs=0x23, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0109.084] ResumeThread (hThread=0x118) returned 0x1 [0109.084] CharUpperBuffW (in: lpsz="RXTMHSDEUWWTMBCYVFVU", cchLength=0x14 | out: lpsz="RXTMHSDEUWWTMBCYVFVU") returned 0x14 [0109.084] CharUpperBuffW (in: lpsz="FDPDPIEJNUQUIGBAIZUL", cchLength=0x14 | out: lpsz="FDPDPIEJNUQUIGBAIZUL") returned 0x14 [0109.130] CharUpperBuffW (in: lpsz="CQIDMLUQPXLJJXJMVGXY", cchLength=0x14 | out: lpsz="CQIDMLUQPXLJJXJMVGXY") returned 0x14 [0109.130] CharUpperBuffW (in: lpsz="NDPUETVCWXC_GCLTORPI", cchLength=0x14 | out: lpsz="NDPUETVCWXC_GCLTORPI") returned 0x14 [0109.130] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0109.130] CharUpperBuffW (in: lpsz="JXIUTGRKIECTYETFFUVY", cchLength=0x14 | out: lpsz="JXIUTGRKIECTYETFFUVY") returned 0x14 [0109.130] CharUpperBuffW (in: lpsz="RPIPRMIRFPBOQWGNHUFS", cchLength=0x14 | out: lpsz="RPIPRMIRFPBOQWGNHUFS") returned 0x14 [0109.130] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0110.330] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0110.330] PeekMessageW (in: lpMsg=0xbae9bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbae9bc) returned 0 [0110.331] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0110.331] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0110.331] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x777b0000 [0110.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OpenProcess", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0110.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OpenProcess", cchWideChar=12, lpMultiByteStr=0x1024cc0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OpenProcess", lpUsedDefaultChar=0x0) returned 12 [0110.332] GetProcAddress (hModule=0x777b0000, lpProcName="OpenProcess") returned 0x777f59d7 [0110.332] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb18) returned 0x12c [0110.332] FreeLibrary (hLibModule=0x777b0000) returned 1 [0110.332] CharUpperBuffW (in: lpsz="MFYVECQHVOGYZWFUNTDZ", cchLength=0x14 | out: lpsz="MFYVECQHVOGYZWFUNTDZ") returned 0x14 [0110.495] CharUpperBuffW (in: lpsz="NUCYQ_YDXJYWOFNYEHKJ", cchLength=0x14 | out: lpsz="NUCYQ_YDXJYWOFNYEHKJ") returned 0x14 [0110.495] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0110.550] CharUpperBuffW (in: lpsz="OLKNRFYRRXZISMVGNLHE", cchLength=0x14 | out: lpsz="OLKNRFYRRXZISMVGNLHE") returned 0x14 [0110.550] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0110.550] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0110.550] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0110.551] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0110.551] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0110.551] CharUpperBuffW (in: lpsz="WTLHCJPNMSGZFENQCDYX", cchLength=0x14 | out: lpsz="WTLHCJPNMSGZFENQCDYX") returned 0x14 [0110.551] LoadLibraryW (lpLibFileName="kernel32") returned 0x777b0000 [0110.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0110.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=12, lpMultiByteStr=0x1024b28, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualFree", lpUsedDefaultChar=0x0) returned 12 [0110.551] GetProcAddress (hModule=0x777b0000, lpProcName="VirtualFree") returned 0x77801da4 [0110.552] FreeLibrary (hLibModule=0x777b0000) returned 1 [0110.552] CharUpperBuffW (in: lpsz="NUCYQ_YDXJYWOFNYEHKJ", cchLength=0x14 | out: lpsz="NUCYQ_YDXJYWOFNYEHKJ") returned 0x14 [0111.520] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0111.520] PeekMessageW (in: lpMsg=0xbaecf4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbaecf4) returned 0 [0111.520] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0111.520] CharUpperBuffW (in: lpsz="OLKNRFYRRXZISMVGNLHE", cchLength=0x14 | out: lpsz="OLKNRFYRRXZISMVGNLHE") returned 0x14 [0111.520] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0111.520] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0111.521] CharUpperBuffW (in: lpsz="RFKUQLZUQAFDEHPMGICW", cchLength=0x14 | out: lpsz="RFKUQLZUQAFDEHPMGICW") returned 0x14 [0111.521] CharUpperBuffW (in: lpsz="0", cchLength=0x1 | out: lpsz="0") returned 0x1 [0111.521] CharUpperBuffW (in: lpsz="NAADHUPEFMHDXQGGQHRU", cchLength=0x14 | out: lpsz="NAADHUPEFMHDXQGGQHRU") returned 0x14 [0111.521] CharUpperBuffW (in: lpsz="WTLHCJPNMSGZFENQCDYX", cchLength=0x14 | out: lpsz="WTLHCJPNMSGZFENQCDYX") returned 0x14 [0111.521] LoadLibraryW (lpLibFileName="kernel32") returned 0x777b0000 [0111.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0111.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=12, lpMultiByteStr=0x1024e28, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualFree", lpUsedDefaultChar=0x0) returned 12 [0111.522] GetProcAddress (hModule=0x777b0000, lpProcName="VirtualFree") returned 0x77801da4 [0111.522] FreeLibrary (hLibModule=0x777b0000) returned 1 [0111.537] timeGetTime () returned 0xa73e3a [0111.537] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0111.537] Sleep (dwMilliseconds=0xa) [0111.605] timeGetTime () returned 0xa73e78 [0111.605] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0111.605] Sleep (dwMilliseconds=0xa) [0111.641] timeGetTime () returned 0xa73ea7 [0111.641] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0111.641] Sleep (dwMilliseconds=0xa) [0111.688] timeGetTime () returned 0xa73ed6 [0111.688] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0111.688] Sleep (dwMilliseconds=0xa) [0111.735] timeGetTime () returned 0xa73f05 [0111.735] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0111.735] Sleep (dwMilliseconds=0xa) [0111.781] timeGetTime () returned 0xa73f34 [0111.782] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0111.782] Sleep (dwMilliseconds=0xa) [0112.609] timeGetTime () returned 0xa7426e [0112.609] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 1 [0112.609] TranslateMessage (lpMsg=0xbafb14) returned 0 [0112.609] DispatchMessageW (lpMsg=0xbafb14) returned 0x0 [0112.609] KillTimer (hWnd=0x701ae, uIDEvent=0x1) returned 1 [0112.609] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0112.609] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0112.609] Sleep (dwMilliseconds=0xa) [0112.655] timeGetTime () returned 0xa7429d [0112.655] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0112.655] Sleep (dwMilliseconds=0xa) [0112.704] timeGetTime () returned 0xa742cc [0112.704] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0112.705] Sleep (dwMilliseconds=0xa) [0112.749] timeGetTime () returned 0xa742fb [0112.749] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0112.749] Sleep (dwMilliseconds=0xa) [0112.797] timeGetTime () returned 0xa7432a [0112.797] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0112.797] Sleep (dwMilliseconds=0xa) [0112.842] timeGetTime () returned 0xa74358 [0112.842] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0112.842] Sleep (dwMilliseconds=0xa) [0112.891] timeGetTime () returned 0xa74387 [0112.891] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0112.891] Sleep (dwMilliseconds=0xa) [0112.936] timeGetTime () returned 0xa743b6 [0112.936] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0112.936] Sleep (dwMilliseconds=0xa) [0112.983] timeGetTime () returned 0xa743e5 [0112.983] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0112.983] Sleep (dwMilliseconds=0xa) [0113.029] timeGetTime () returned 0xa74414 [0113.029] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.030] Sleep (dwMilliseconds=0xa) [0113.076] timeGetTime () returned 0xa74442 [0113.076] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.076] Sleep (dwMilliseconds=0xa) [0113.124] timeGetTime () returned 0xa74471 [0113.124] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.124] Sleep (dwMilliseconds=0xa) [0113.159] timeGetTime () returned 0xa74490 [0113.159] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.159] Sleep (dwMilliseconds=0xa) [0113.201] timeGetTime () returned 0xa744bf [0113.201] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.201] Sleep (dwMilliseconds=0xa) [0113.248] timeGetTime () returned 0xa744ee [0113.248] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.248] Sleep (dwMilliseconds=0xa) [0113.295] timeGetTime () returned 0xa7451d [0113.295] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.295] Sleep (dwMilliseconds=0xa) [0113.342] timeGetTime () returned 0xa7454c [0113.342] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.342] Sleep (dwMilliseconds=0xa) [0113.388] timeGetTime () returned 0xa7457a [0113.388] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 1 [0113.388] TranslateMessage (lpMsg=0xbafb14) returned 0 [0113.389] DispatchMessageW (lpMsg=0xbafb14) returned 0x0 [0113.389] KillTimer (hWnd=0x701ae, uIDEvent=0x1) returned 1 [0113.389] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0113.389] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.389] Sleep (dwMilliseconds=0xa) [0113.435] timeGetTime () returned 0xa745a9 [0113.435] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.435] Sleep (dwMilliseconds=0xa) [0113.468] timeGetTime () returned 0xa745c8 [0113.468] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.468] Sleep (dwMilliseconds=0xa) [0113.513] timeGetTime () returned 0xa745f7 [0113.513] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.513] Sleep (dwMilliseconds=0xa) [0113.549] timeGetTime () returned 0xa74616 [0113.549] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.549] Sleep (dwMilliseconds=0xa) [0113.591] timeGetTime () returned 0xa74645 [0113.591] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.591] Sleep (dwMilliseconds=0xa) [0113.638] timeGetTime () returned 0xa74674 [0113.638] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.638] Sleep (dwMilliseconds=0xa) [0113.685] timeGetTime () returned 0xa746a3 [0113.685] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.685] Sleep (dwMilliseconds=0xa) [0113.732] timeGetTime () returned 0xa746d2 [0113.732] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.732] Sleep (dwMilliseconds=0xa) [0113.778] timeGetTime () returned 0xa74700 [0113.778] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.778] Sleep (dwMilliseconds=0xa) [0113.815] timeGetTime () returned 0xa74720 [0113.815] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.815] Sleep (dwMilliseconds=0xa) [0113.856] timeGetTime () returned 0xa7474e [0113.856] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.856] Sleep (dwMilliseconds=0xa) [0113.906] timeGetTime () returned 0xa7477d [0113.906] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.906] Sleep (dwMilliseconds=0xa) [0113.950] timeGetTime () returned 0xa747ac [0113.950] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.950] Sleep (dwMilliseconds=0xa) [0113.997] timeGetTime () returned 0xa747db [0113.997] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0113.997] Sleep (dwMilliseconds=0xa) [0114.044] timeGetTime () returned 0xa7480a [0114.044] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.044] Sleep (dwMilliseconds=0xa) [0114.076] timeGetTime () returned 0xa74829 [0114.076] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.076] Sleep (dwMilliseconds=0xa) [0114.122] timeGetTime () returned 0xa74858 [0114.122] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.122] Sleep (dwMilliseconds=0xa) [0114.168] timeGetTime () returned 0xa74886 [0114.168] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 1 [0114.168] TranslateMessage (lpMsg=0xbafb14) returned 0 [0114.168] DispatchMessageW (lpMsg=0xbafb14) returned 0x0 [0114.168] KillTimer (hWnd=0x701ae, uIDEvent=0x1) returned 1 [0114.168] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0114.168] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.168] Sleep (dwMilliseconds=0xa) [0114.207] timeGetTime () returned 0xa748a6 [0114.207] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.207] Sleep (dwMilliseconds=0xa) [0114.246] timeGetTime () returned 0xa748d4 [0114.246] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.247] Sleep (dwMilliseconds=0xa) [0114.293] timeGetTime () returned 0xa74903 [0114.293] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.293] Sleep (dwMilliseconds=0xa) [0114.340] timeGetTime () returned 0xa74932 [0114.340] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.340] Sleep (dwMilliseconds=0xa) [0114.387] timeGetTime () returned 0xa74961 [0114.387] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.387] Sleep (dwMilliseconds=0xa) [0114.433] timeGetTime () returned 0xa74990 [0114.434] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.434] Sleep (dwMilliseconds=0xa) [0114.467] timeGetTime () returned 0xa749af [0114.467] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.467] Sleep (dwMilliseconds=0xa) [0114.560] timeGetTime () returned 0xa74a0c [0114.560] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.560] Sleep (dwMilliseconds=0xa) [0114.948] timeGetTime () returned 0xa74b83 [0114.948] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 1 [0114.948] TranslateMessage (lpMsg=0xbafb14) returned 0 [0114.948] DispatchMessageW (lpMsg=0xbafb14) returned 0x0 [0114.948] KillTimer (hWnd=0x701ae, uIDEvent=0x1) returned 1 [0114.948] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0114.948] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0114.948] Sleep (dwMilliseconds=0xa) [0115.004] timeGetTime () returned 0xa74bc1 [0115.004] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0115.004] Sleep (dwMilliseconds=0xa) [0115.109] timeGetTime () returned 0xa74c2e [0115.110] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0115.110] Sleep (dwMilliseconds=0xa) [0115.151] timeGetTime () returned 0xa74c5d [0115.152] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0115.152] Sleep (dwMilliseconds=0xa) [0115.385] timeGetTime () returned 0xa74d47 [0115.385] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0115.385] Sleep (dwMilliseconds=0xa) [0115.432] timeGetTime () returned 0xa74d76 [0115.432] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0115.432] Sleep (dwMilliseconds=0xa) [0115.650] timeGetTime () returned 0xa74e50 [0115.650] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0115.650] Sleep (dwMilliseconds=0xa) [0115.690] timeGetTime () returned 0xa74e70 [0115.690] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0115.690] Sleep (dwMilliseconds=0xa) [0115.728] timeGetTime () returned 0xa74e9e [0115.728] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 1 [0115.728] TranslateMessage (lpMsg=0xbafb14) returned 0 [0115.728] DispatchMessageW (lpMsg=0xbafb14) returned 0x0 [0115.728] KillTimer (hWnd=0x701ae, uIDEvent=0x1) returned 1 [0115.728] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0115.729] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0115.729] Sleep (dwMilliseconds=0xa) [0115.775] timeGetTime () returned 0xa74ecd [0115.775] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0115.775] Sleep (dwMilliseconds=0xa) [0115.819] timeGetTime () returned 0xa74eec [0115.819] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0115.819] Sleep (dwMilliseconds=0xa) [0117.201] timeGetTime () returned 0xa75459 [0117.201] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 1 [0117.201] TranslateMessage (lpMsg=0xbafb14) returned 0 [0117.201] DispatchMessageW (lpMsg=0xbafb14) returned 0x0 [0117.201] KillTimer (hWnd=0x701ae, uIDEvent=0x1) returned 1 [0117.202] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0117.202] PeekMessageW (in: lpMsg=0xbafb14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafb14) returned 0 [0117.202] Sleep (dwMilliseconds=0xa) [0122.907] timeGetTime () returned 0xa76aa6 [0122.908] SetTimer (hWnd=0x701ae, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0122.908] PeekMessageW (in: lpMsg=0xbafcfc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbafcfc) returned 0 [0122.908] CharUpperBuffW (in: lpsz="CUKXVXVZGVOUEYETKUUTEC", cchLength=0x16 | out: lpsz="CUKXVXVZGVOUEYETKUUTEC") returned 0x16 [0122.908] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 0x2013 [0122.908] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", nBufferLength=0x7fff, lpBuffer=0xb9f2b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", lpFilePart=0x0) returned 0x26 [0122.909] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 0x2013 [0122.909] FindFirstFileW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\*.*", lpFindFileData=0xbaf2f8 | out: lpFindFileData=0xbaf2f8) returned 0x1007840 [0122.909] FindNextFileW (in: hFindFile=0x1007840, lpFindFileData=0xbaf2f8 | out: lpFindFileData=0xbaf2f8) returned 1 [0122.909] FindNextFileW (in: hFindFile=0x1007840, lpFindFileData=0xbaf2f8 | out: lpFindFileData=0xbaf2f8) returned 1 [0122.909] DeleteFileW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0 [0122.909] FindClose (in: hFindFile=0x1007840 | out: hFindFile=0x1007840) returned 1 [0122.909] CharUpperBuffW (in: lpsz="LMGXO__VIDUBLBNQ_URO", cchLength=0x14 | out: lpsz="LMGXO__VIDUBLBNQ_URO") returned 0x14 [0122.916] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 0x2013 [0122.916] CharUpperBuffW (in: lpsz="CUHEVSXEDUELZVLIEXJU", cchLength=0x14 | out: lpsz="CUHEVSXEDUELZVLIEXJU") returned 0x14 [0122.916] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xb9f228, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0122.916] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xb9f228, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0122.917] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:", cchCount1=2, lpString2="C:", cchCount2=2) returned 2 [0122.917] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x2023 [0122.917] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x2023 [0122.917] FindFirstFileW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFindFileData=0xbaf240 | out: lpFindFileData=0xbaf240) returned 0x10079c0 [0122.917] GetFileAttributesW (lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x2023 [0122.917] FindClose (in: hFindFile=0x10079c0 | out: hFindFile=0x10079c0) returned 1 [0122.917] CharUpperBuffW (in: lpsz="ZFRTZZSAHZYYERUFUTKH", cchLength=0x14 | out: lpsz="ZFRTZZSAHZYYERUFUTKH") returned 0x14 [0122.923] GetWindowTextW (in: hWnd=0x10066, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.923] GetClassNameW (in: hWnd=0x10066, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.923] GetWindowTextW (in: hWnd=0x10064, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.923] GetClassNameW (in: hWnd=0x10064, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.923] GetWindowTextW (in: hWnd=0x10050, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.923] GetClassNameW (in: hWnd=0x10050, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.923] GetWindowTextW (in: hWnd=0x10078, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.923] GetClassNameW (in: hWnd=0x10078, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.923] GetWindowTextW (in: hWnd=0x1006e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.923] GetClassNameW (in: hWnd=0x1006e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.923] GetWindowTextW (in: hWnd=0x1006c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.923] GetClassNameW (in: hWnd=0x1006c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.924] GetWindowTextW (in: hWnd=0x10068, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x10068, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.924] GetWindowTextW (in: hWnd=0x10048, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Start") returned 5 [0122.924] GetClassNameW (in: hWnd=0x10048, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Button") returned 6 [0122.924] GetWindowTextW (in: hWnd=0x2001e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x2001e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0122.924] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0122.924] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="ATL:6E918158") returned 12 [0122.924] GetWindowTextW (in: hWnd=0x10114, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Task Switching") returned 14 [0122.924] GetClassNameW (in: hWnd=0x10114, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="TaskSwitcherWnd") returned 15 [0122.924] GetWindowTextW (in: hWnd=0x100da, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x100da, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.924] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.924] GetWindowTextW (in: hWnd=0x100bc, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x100bc, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.924] GetWindowTextW (in: hWnd=0x10094, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x10094, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.924] GetWindowTextW (in: hWnd=0x50082, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x50082, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.924] GetWindowTextW (in: hWnd=0x1007a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x1007a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0122.924] GetWindowTextW (in: hWnd=0x1008c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="JPenUM") returned 6 [0122.924] GetClassNameW (in: hWnd=0x1008c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Desktop User Picture") returned 20 [0122.924] GetWindowTextW (in: hWnd=0x2022c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x2022c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.924] GetWindowTextW (in: hWnd=0x301b8, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x301b8, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.924] GetWindowTextW (in: hWnd=0x3019a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.924] GetClassNameW (in: hWnd=0x3019a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.925] GetWindowTextW (in: hWnd=0x20228, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.925] GetClassNameW (in: hWnd=0x20228, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.925] GetWindowTextW (in: hWnd=0x20238, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.925] GetClassNameW (in: hWnd=0x20238, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.925] GetWindowTextW (in: hWnd=0x20234, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.925] GetClassNameW (in: hWnd=0x20234, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.925] GetWindowTextW (in: hWnd=0x20220, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.925] GetClassNameW (in: hWnd=0x20220, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.927] GetWindowTextW (in: hWnd=0x2025c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.927] GetClassNameW (in: hWnd=0x2025c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.927] GetWindowTextW (in: hWnd=0x20266, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.927] GetClassNameW (in: hWnd=0x20266, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.927] GetWindowTextW (in: hWnd=0x20268, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.927] GetClassNameW (in: hWnd=0x20268, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.927] GetWindowTextW (in: hWnd=0x20246, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.927] GetClassNameW (in: hWnd=0x20246, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.929] GetWindowTextW (in: hWnd=0x20254, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.929] GetClassNameW (in: hWnd=0x20254, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.929] GetWindowTextW (in: hWnd=0x20250, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.930] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.930] GetWindowTextW (in: hWnd=0x2024a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.930] GetClassNameW (in: hWnd=0x2024a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.930] GetWindowTextW (in: hWnd=0x2024c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.930] GetClassNameW (in: hWnd=0x2024c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.930] GetWindowTextW (in: hWnd=0x2021e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.930] GetClassNameW (in: hWnd=0x2021e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.930] GetWindowTextW (in: hWnd=0x2020e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.930] GetClassNameW (in: hWnd=0x2020e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.930] GetWindowTextW (in: hWnd=0x20216, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.930] GetClassNameW (in: hWnd=0x20216, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.930] GetWindowTextW (in: hWnd=0x201f6, lpString=0xbaec78, nMaxCount=1024 | out: lpString="b106484eb915e4ad6df697dc1442cbff-EDITED - Windows Photo Viewer") returned 62 [0122.930] GetClassNameW (in: hWnd=0x201f6, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Photo_Lightweight_Viewer") returned 24 [0122.930] GetWindowTextW (in: hWnd=0x701ae, lpString=0xbaec78, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0122.930] DefWindowProcW (hWnd=0x701ae, Msg=0xd, wParam=0x400, lParam=0xbaec78) returned 0x9 [0122.930] GetClassNameW (in: hWnd=0x701ae, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0122.930] GetWindowTextW (in: hWnd=0x300e6, lpString=0xbaec78, nMaxCount=1024 | out: lpString="TaskEng - Task Scheduler Engine Process") returned 39 [0122.930] GetClassNameW (in: hWnd=0x300e6, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0122.930] GetWindowTextW (in: hWnd=0x30282, lpString=0xbaec78, nMaxCount=1024 | out: lpString=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0122.930] GetClassNameW (in: hWnd=0x30282, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0") returned 43 [0122.930] GetWindowTextW (in: hWnd=0x20286, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.930] GetClassNameW (in: hWnd=0x20286, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0122.930] GetWindowTextW (in: hWnd=0x30130, lpString=0xbaec78, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0122.930] GetClassNameW (in: hWnd=0x30130, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0122.930] GetWindowTextW (in: hWnd=0x20198, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Oil") returned 3 [0122.930] GetClassNameW (in: hWnd=0x20198, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Oilwindow") returned 9 [0122.930] GetWindowTextW (in: hWnd=0x20178, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Thorough") returned 8 [0122.930] GetClassNameW (in: hWnd=0x20178, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="thorough_wnd") returned 12 [0122.930] GetWindowTextW (in: hWnd=0x20176, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Runner") returned 6 [0122.930] GetClassNameW (in: hWnd=0x20176, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Runner_") returned 7 [0122.931] GetWindowTextW (in: hWnd=0x2016e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Horror Pamela Aspect") returned 20 [0122.931] GetClassNameW (in: hWnd=0x2016e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Horror_Pamela_aspect_") returned 21 [0122.931] GetWindowTextW (in: hWnd=0x2016a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Fw Panama") returned 9 [0122.931] GetClassNameW (in: hWnd=0x2016a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Fw_panama_win") returned 13 [0122.931] GetWindowTextW (in: hWnd=0x3019e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Friendly Mexican") returned 16 [0122.931] GetClassNameW (in: hWnd=0x3019e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="friendlymexicancls") returned 18 [0122.931] GetWindowTextW (in: hWnd=0x30188, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Streams Xi") returned 10 [0122.931] GetClassNameW (in: hWnd=0x30188, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="streams_xi_app") returned 14 [0122.931] GetWindowTextW (in: hWnd=0x20164, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Charging") returned 8 [0122.931] GetClassNameW (in: hWnd=0x20164, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="chargingclass") returned 13 [0122.931] GetWindowTextW (in: hWnd=0x20160, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Cut Menu") returned 8 [0122.931] GetClassNameW (in: hWnd=0x20160, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="CutMenucls") returned 10 [0122.931] GetWindowTextW (in: hWnd=0x2015c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Arab Roulette If") returned 16 [0122.931] GetClassNameW (in: hWnd=0x2015c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Arab_Roulette_If_win") returned 20 [0122.931] GetWindowTextW (in: hWnd=0x20158, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Resolved") returned 8 [0122.931] GetClassNameW (in: hWnd=0x20158, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Resolved_window") returned 15 [0122.931] GetWindowTextW (in: hWnd=0x40152, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Career Favorites") returned 16 [0122.931] GetClassNameW (in: hWnd=0x40152, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="CareerFavoritescls") returned 18 [0122.931] GetWindowTextW (in: hWnd=0xd013a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Hoped Departure") returned 15 [0122.931] GetClassNameW (in: hWnd=0xd013a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Hoped_departure_cls") returned 19 [0122.931] GetWindowTextW (in: hWnd=0x301bc, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Delicious Zu") returned 12 [0122.931] GetClassNameW (in: hWnd=0x301bc, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="deliciouszuclass") returned 16 [0122.931] GetWindowTextW (in: hWnd=0x300dc, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Modems Windows") returned 14 [0122.931] GetClassNameW (in: hWnd=0x300dc, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="modems_Windows_win") returned 18 [0122.931] GetWindowTextW (in: hWnd=0x30174, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Frame Highlighted Amp") returned 21 [0122.931] GetClassNameW (in: hWnd=0x30174, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="FramehighlightedAmpwindow") returned 25 [0122.931] GetWindowTextW (in: hWnd=0x20148, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Initiated") returned 9 [0122.931] GetClassNameW (in: hWnd=0x20148, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Initiatedclass") returned 14 [0122.932] GetWindowTextW (in: hWnd=0x20142, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Would Raw Cycles") returned 16 [0122.932] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Wouldrawcycleswindow") returned 20 [0122.932] GetWindowTextW (in: hWnd=0x30144, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Cutting Registry") returned 16 [0122.932] GetClassNameW (in: hWnd=0x30144, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Cutting_registry_win") returned 20 [0122.932] GetWindowTextW (in: hWnd=0x901b0, lpString=0xbaec78, nMaxCount=1024 | out: lpString="OfficePowerManagerWindow") returned 24 [0122.932] GetClassNameW (in: hWnd=0x901b0, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0122.932] GetWindowTextW (in: hWnd=0x501a4, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Microsoft Office Sync Process") returned 29 [0122.932] GetClassNameW (in: hWnd=0x501a4, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Microsoft.Office15.MsoSync") returned 26 [0122.932] GetWindowTextW (in: hWnd=0x201a8, lpString=0xbaec78, nMaxCount=1024 | out: lpString="GDI+ Window") returned 11 [0122.932] GetClassNameW (in: hWnd=0x201a8, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0122.932] GetWindowTextW (in: hWnd=0x2014e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.932] GetClassNameW (in: hWnd=0x2014e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="ARC Window Class") returned 16 [0122.932] GetWindowTextW (in: hWnd=0x101be, lpString=0xbaec78, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0122.932] GetClassNameW (in: hWnd=0x101be, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0122.932] GetWindowTextW (in: hWnd=0x4013c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="HiddenFaxWindow") returned 15 [0122.932] GetClassNameW (in: hWnd=0x4013c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0122.932] GetWindowTextW (in: hWnd=0x10128, lpString=0xbaec78, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0122.932] GetClassNameW (in: hWnd=0x10128, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0122.932] GetWindowTextW (in: hWnd=0x20126, lpString=0xbaec78, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0122.932] GetClassNameW (in: hWnd=0x20126, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0122.932] GetWindowTextW (in: hWnd=0x2011a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.932] GetClassNameW (in: hWnd=0x2011a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0122.932] GetWindowTextW (in: hWnd=0x1010a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Media Center SSO") returned 16 [0122.932] GetClassNameW (in: hWnd=0x1010a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Media Center SSO") returned 16 [0122.932] GetWindowTextW (in: hWnd=0x10102, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.932] GetClassNameW (in: hWnd=0x10102, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="ATL:72973188") returned 12 [0122.933] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0122.933] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0122.933] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0122.933] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0122.933] GetWindowTextW (in: hWnd=0x20034, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x20034, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0122.933] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.933] GetWindowTextW (in: hWnd=0x100c2, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x100c2, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0122.933] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0122.933] GetWindowTextW (in: hWnd=0x100ac, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x100ac, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.933] GetWindowTextW (in: hWnd=0x100a6, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x100a6, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.933] GetWindowTextW (in: hWnd=0x200a0, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x200a0, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.933] GetWindowTextW (in: hWnd=0x10086, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Start menu") returned 10 [0122.933] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0122.933] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Jump List") returned 9 [0122.933] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="DV2ControlHost") returned 14 [0122.933] GetWindowTextW (in: hWnd=0x40024, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x40024, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0122.933] GetWindowTextW (in: hWnd=0x10072, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x10072, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0122.933] GetWindowTextW (in: hWnd=0x1006a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.933] GetClassNameW (in: hWnd=0x1006a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.934] GetWindowTextW (in: hWnd=0x10058, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.934] GetClassNameW (in: hWnd=0x10058, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0122.934] GetWindowTextW (in: hWnd=0x100e2, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.934] GetClassNameW (in: hWnd=0x100e2, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0122.934] GetWindowTextW (in: hWnd=0x10054, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.934] GetClassNameW (in: hWnd=0x10054, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0122.934] GetWindowTextW (in: hWnd=0x2001a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0122.934] GetClassNameW (in: hWnd=0x2001a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0122.934] GetWindowTextW (in: hWnd=0x30028, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.934] GetClassNameW (in: hWnd=0x30028, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0122.934] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.934] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0122.934] GetWindowTextW (in: hWnd=0x1003a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="MCI command handling window") returned 27 [0122.934] GetClassNameW (in: hWnd=0x1003a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="#43") returned 3 [0122.934] GetWindowTextW (in: hWnd=0x1002e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0122.934] GetClassNameW (in: hWnd=0x1002e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0122.934] GetWindowTextW (in: hWnd=0x10036, lpString=0xbaec78, nMaxCount=1024 | out: lpString="") returned 0 [0122.934] GetClassNameW (in: hWnd=0x10036, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0122.934] GetWindowTextW (in: hWnd=0x30026, lpString=0xbaec78, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0122.934] GetClassNameW (in: hWnd=0x30026, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0122.934] GetWindowTextW (in: hWnd=0x100d0, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0122.934] GetClassNameW (in: hWnd=0x100d0, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0122.934] GetWindowTextW (in: hWnd=0x20020, lpString=0xbaec78, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0122.934] GetClassNameW (in: hWnd=0x20020, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0122.934] GetWindowTextW (in: hWnd=0x20022, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.934] GetClassNameW (in: hWnd=0x20022, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.934] GetWindowTextW (in: hWnd=0x10116, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.934] GetClassNameW (in: hWnd=0x10116, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.934] GetWindowTextW (in: hWnd=0x2022e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0122.934] GetClassNameW (in: hWnd=0x2022e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0122.934] GetWindowTextW (in: hWnd=0x301f8, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x301f8, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x20242, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x20242, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x40204, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x40204, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x20278, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x20278, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x30200, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x30200, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x201d2, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x201d2, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x20182, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x20182, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x20180, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x20180, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x20170, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x20170, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x2016c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x2016c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x20168, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x20168, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x3019c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x3019c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.935] GetWindowTextW (in: hWnd=0x20166, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.935] GetClassNameW (in: hWnd=0x20166, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x20162, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x20162, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x2015e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x2015e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x2015a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x2015a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x20156, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x20156, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x40150, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x40150, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x201ba, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x201ba, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x20172, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x20172, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x4010e, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x4010e, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x2014a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x2014a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x20146, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x20146, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x30140, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x30140, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x20154, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x20154, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x101c0, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x101c0, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x1010c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.936] GetClassNameW (in: hWnd=0x1010c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.936] GetWindowTextW (in: hWnd=0x10104, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.937] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.937] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.937] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.937] GetWindowTextW (in: hWnd=0x1003c, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.937] GetClassNameW (in: hWnd=0x1003c, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.937] GetWindowTextW (in: hWnd=0x10030, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.937] GetClassNameW (in: hWnd=0x10030, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.937] GetWindowTextW (in: hWnd=0x10038, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.937] GetClassNameW (in: hWnd=0x10038, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.937] GetWindowTextW (in: hWnd=0x100ec, lpString=0xbaec78, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0122.937] GetClassNameW (in: hWnd=0x100ec, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0122.937] GetWindowTextW (in: hWnd=0x2002a, lpString=0xbaec78, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0122.937] GetClassNameW (in: hWnd=0x2002a, lpClassName=0xbaec78, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0122.937] CharUpperBuffW (in: lpsz="LMGXO__VIDUBLBNQ_URO", cchLength=0x14 | out: lpsz="LMGXO__VIDUBLBNQ_URO") returned 0x14 [0122.961] CharUpperBuffW (in: lpsz="CUHEVSXEDUELZVLIEXJU", cchLength=0x14 | out: lpsz="CUHEVSXEDUELZVLIEXJU") returned 0x14 [0122.999] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", nBufferLength=0x7fff, lpBuffer=0xb7ef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", lpFilePart=0x0) returned 0x33 [0123.000] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xb8f558 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0123.000] SetCurrentDirectoryW (lpPathName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 1 [0123.000] GetFileAttributesW (lpFileName="RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x2023 [0123.000] FindFirstFileW (in: lpFileName="RtlUpd64.exe", lpFindFileData=0xb8ecb8 | out: lpFindFileData=0xb8ecb8) returned 0x10079c0 [0123.000] GetFileAttributesW (lpFileName="RtlUpd64.exe" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr\\rtlupd64.exe")) returned 0x2023 [0123.000] SetFileAttributesW (lpFileName="RtlUpd64.exe", dwFileAttributes=0x2023) returned 1 [0123.000] FindNextFileW (in: hFindFile=0x10079c0, lpFindFileData=0xb8ecb8 | out: lpFindFileData=0xb8ecb8) returned 0 [0123.000] FindClose (in: hFindFile=0x10079c0 | out: hFindFile=0x10079c0) returned 1 [0123.001] SetCurrentDirectoryW (lpPathName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 1 [0123.001] CharUpperBuffW (in: lpsz="KUJEVWMGAPXSFGHGYTMN", cchLength=0x14 | out: lpsz="KUJEVWMGAPXSFGHGYTMN") returned 0x14 [0123.001] GetFullPathNameW (in: lpFileName="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", nBufferLength=0x7fff, lpBuffer=0xb7ef20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", lpFilePart=0x0) returned 0x26 [0123.001] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xb8f558 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0123.001] SetCurrentDirectoryW (lpPathName="C:\\Users\\JPenUM\\AppData\\Roaming\\" (normalized: "c:\\users\\jpenum\\appdata\\roaming")) returned 1 [0123.001] GetFileAttributesW (lpFileName="appmgr" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 0x2013 [0123.001] GetFileAttributesW (lpFileName="appmgr" (normalized: "c:\\users\\jpenum\\appdata\\roaming\\appmgr")) returned 0x2013 [0123.001] SetFileAttributesW (lpFileName="appmgr", dwFileAttributes=0x2013) returned 1 [0123.002] SetCurrentDirectoryW (lpPathName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 1 [0123.002] CharUpperBuffW (in: lpsz="LPXKHVWBHHWHBOBTGAID", cchLength=0x14 | out: lpsz="LPXKHVWBHHWHBOBTGAID") returned 0x14 [0123.002] CharUpperBuffW (in: lpsz="XYDBLSCNDIODUIBUOMWE", cchLength=0x14 | out: lpsz="XYDBLSCNDIODUIBUOMWE") returned 0x14 [0123.002] CharUpperBuffW (in: lpsz="XLXFAITACZQESJDYDOJW", cchLength=0x14 | out: lpsz="XLXFAITACZQESJDYDOJW") returned 0x14 [0123.002] CharUpperBuffW (in: lpsz="CUHEVSXEDUELZVLIEXJU", cchLength=0x14 | out: lpsz="CUHEVSXEDUELZVLIEXJU") returned 0x14 [0123.002] CharUpperBuffW (in: lpsz="LVTDPVFBPHVXPQMTNUXB", cchLength=0x14 | out: lpsz="LVTDPVFBPHVXPQMTNUXB") returned 0x14 [0123.003] ShellExecuteExW (in: pExecInfo=0xbaf4e0*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="schtasks", lpParameters="/create /tn RtkAudioService64 /tr \"C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe\" /sc minute /mo 1 /F", lpDirectory="C:\\Windows\\system32", nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0xbaf4e0*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="schtasks", lpParameters="/create /tn RtkAudioService64 /tr \"C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe\" /sc minute /mo 1 /F", lpDirectory="C:\\Windows\\system32", nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x214)) returned 1 [0123.128] GetProcessId (Process=0x214) returned 0x7a4 [0123.128] CloseHandle (hObject=0x214) returned 1 [0123.128] CharUpperBuffW (in: lpsz="EOYHLBQUNPHWLCZHVIPGMR", cchLength=0x16 | out: lpsz="EOYHLBQUNPHWLCZHVIPGMR") returned 0x16 [0123.128] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", cchCount1=38, lpString2="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr", cchCount2=38) returned 2 [0123.128] LockWindowUpdate (hWndLock=0x0) returned 0 [0123.128] DestroyWindow (hWnd=0x701ae) returned 1 [0123.128] DefWindowProcW (hWnd=0x701ae, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0123.129] KillTimer (hWnd=0x701ae, uIDEvent=0x1) returned 1 [0123.130] PostQuitMessage (nExitCode=0) [0123.130] GetMessageW (in: lpMsg=0xbafdb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xbafdb4) returned 0 [0126.288] SetCurrentDirectoryW (lpPathName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 1 [0126.288] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 0 [0126.292] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0126.293] OleUninitialize () [0126.302] DestroyCursor (hCursor=0xb0213) returned 0 [0126.302] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0xbcfdec | out: phModule=0xbcfdec) returned 0 [0126.302] ExitProcess (uExitCode=0x0) Thread: id = 265 os_tid = 0xbb8 Thread: id = 266 os_tid = 0xbb0 Thread: id = 267 os_tid = 0xbac Thread: id = 268 os_tid = 0x1cc Process: id = "19" image_name = "regasm.exe" filename = "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe" page_root = "0x7f1f66c0" os_pid = "0xb18" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x15c" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2894 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2895 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2896 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2897 start_va = 0x130000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2898 start_va = 0x400000 end_va = 0x455fff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2899 start_va = 0xf70000 end_va = 0xf7ffff entry_point = 0xf70000 region_type = mapped_file name = "regasm.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe") Region: id = 2900 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2901 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2902 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 2903 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 2904 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 2905 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2906 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2907 start_va = 0x290000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2908 start_va = 0x6fce0000 end_va = 0x6fd29fff entry_point = 0x6fce0000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 2909 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2910 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2911 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 2912 start_va = 0x500000 end_va = 0x50ffff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 2913 start_va = 0x650000 end_va = 0x68ffff entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 2914 start_va = 0x870000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 2915 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2916 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2917 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2918 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2919 start_va = 0x698d0000 end_va = 0x69947fff entry_point = 0x698d0000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 2920 start_va = 0x510000 end_va = 0x5d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 2921 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2922 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2923 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2924 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2925 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2926 start_va = 0x771d0000 end_va = 0x77226fff entry_point = 0x771d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2927 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2928 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2929 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2930 start_va = 0x690000 end_va = 0x790fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 2931 start_va = 0xf80000 end_va = 0x1b7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f80000" filename = "" Region: id = 2932 start_va = 0x74f80000 end_va = 0x74f88fff entry_point = 0x74f80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2933 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2934 start_va = 0x9c0000 end_va = 0x9fffff entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 2935 start_va = 0x62480000 end_va = 0x62a2afff entry_point = 0x62480000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 2936 start_va = 0x62fb0000 end_va = 0x6304afff entry_point = 0x62fb0000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll") Region: id = 2937 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2938 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2939 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2940 start_va = 0x110000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2941 start_va = 0x120000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2942 start_va = 0x230000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2943 start_va = 0x240000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2944 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2945 start_va = 0x260000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2946 start_va = 0xb30000 end_va = 0xc2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 2947 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 2948 start_va = 0x75f10000 end_va = 0x76b59fff entry_point = 0x75f10000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2949 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2950 start_va = 0xc30000 end_va = 0xefefff entry_point = 0xc30000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2951 start_va = 0x75a30000 end_va = 0x75a3afff entry_point = 0x75a30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2952 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2953 start_va = 0x460000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 2954 start_va = 0x1b80000 end_va = 0x3b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b80000" filename = "" Region: id = 2955 start_va = 0x390000 end_va = 0x3ebfff entry_point = 0x390000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2956 start_va = 0x3c90000 end_va = 0x3d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c90000" filename = "" Region: id = 2957 start_va = 0x61980000 end_va = 0x62477fff entry_point = 0x61980000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll") Region: id = 2958 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 2959 start_va = 0x390000 end_va = 0x3ebfff entry_point = 0x390000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2960 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2961 start_va = 0x74060000 end_va = 0x7409ffff entry_point = 0x74060000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2962 start_va = 0x7a0000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 2963 start_va = 0x880000 end_va = 0x95efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 2964 start_va = 0x280000 end_va = 0x282fff entry_point = 0x280000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls") Region: id = 2965 start_va = 0x390000 end_va = 0x39cfff entry_point = 0x390000 region_type = mapped_file name = "regasm.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe") Region: id = 2966 start_va = 0x752a0000 end_va = 0x752dafff entry_point = 0x752a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2967 start_va = 0x75500000 end_va = 0x75515fff entry_point = 0x75500000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2968 start_va = 0x390000 end_va = 0x390fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000390000" filename = "" Region: id = 2969 start_va = 0x62f50000 end_va = 0x62faafff entry_point = 0x62f50000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll") Region: id = 2970 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2971 start_va = 0x3c0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 2972 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x3b0000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 2973 start_va = 0x3d0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2974 start_va = 0x3e0000 end_va = 0x3e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 2975 start_va = 0x3f0000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 2976 start_va = 0x5e0000 end_va = 0x620fff entry_point = 0x5e0000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 2977 start_va = 0x60340000 end_va = 0x60347fff entry_point = 0x60340000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll") Region: id = 2978 start_va = 0x7a0000 end_va = 0x7f3fff entry_point = 0x7a0000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorrc.dll") Region: id = 2979 start_va = 0x830000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 2980 start_va = 0x611e0000 end_va = 0x6197bfff entry_point = 0x611e0000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\system.ni.dll") Region: id = 2981 start_va = 0x3e0000 end_va = 0x3eafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 2982 start_va = 0xa00000 end_va = 0xaa8fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 2983 start_va = 0x3d90000 end_va = 0x4d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d90000" filename = "" Region: id = 2984 start_va = 0x4d90000 end_va = 0x4ebffff entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 2985 start_va = 0x460000 end_va = 0x483fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 2986 start_va = 0x3d90000 end_va = 0x4d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d90000" filename = "" Region: id = 2987 start_va = 0x4ec0000 end_va = 0x5ebffff entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 2988 start_va = 0x5ec0000 end_va = 0x610ffff entry_point = 0x0 region_type = private name = "private_0x0000000005ec0000" filename = "" Region: id = 2989 start_va = 0x4a0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 2990 start_va = 0x4b0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 2991 start_va = 0x490000 end_va = 0x496fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2992 start_va = 0x4c0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 2993 start_va = 0x4d0000 end_va = 0x4d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 2994 start_va = 0x3b80000 end_va = 0x3c3ffff entry_point = 0x3b80000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2995 start_va = 0x6130000 end_va = 0x622ffff entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2996 start_va = 0x6350000 end_va = 0x644ffff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 2997 start_va = 0x602d0000 end_va = 0x6046afff entry_point = 0x602d0000 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualBas#\\08d608378aa405adc844f3cf36974b8c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualbas#\\08d608378aa405adc844f3cf36974b8c\\microsoft.visualbasic.ni.dll") Region: id = 2998 start_va = 0x60470000 end_va = 0x6104dfff entry_point = 0x60470000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\3afcd5168c7a6cb02eab99d7fd71e102\\system.windows.forms.ni.dll") Region: id = 2999 start_va = 0x61050000 end_va = 0x611d7fff entry_point = 0x61050000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\system.drawing.ni.dll") Region: id = 3000 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 3001 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 3006 start_va = 0x6610000 end_va = 0x670ffff entry_point = 0x0 region_type = private name = "private_0x0000000006610000" filename = "" Region: id = 3007 start_va = 0x6740000 end_va = 0x683ffff entry_point = 0x0 region_type = private name = "private_0x0000000006740000" filename = "" Region: id = 3008 start_va = 0x75a20000 end_va = 0x75a2dfff entry_point = 0x75a20000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3009 start_va = 0x7ffd8000 end_va = 0x7ffd8fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 3010 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Thread: id = 254 os_tid = 0xaf4 [0110.568] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0111.551] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x22e750, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0111.551] GetLastError () returned 0x2 [0111.556] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x22e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0111.556] GetLastError () returned 0x2 [0111.558] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x22e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0111.558] GetLastError () returned 0x2 [0111.562] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x22e750, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0111.562] GetLastError () returned 0x2 [0111.562] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x22e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0111.562] GetLastError () returned 0x2 [0111.566] GetVersionExW (in: lpVersionInformation=0x2d0080*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2d0080*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0111.566] GetLastError () returned 0x2 [0111.567] GetVersionExW (in: lpVersionInformation=0x2d0080*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2d0080*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0111.567] GetLastError () returned 0x2 [0112.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x22e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0112.628] GetLastError () returned 0x0 [0112.628] GetVersionExW (in: lpVersionInformation=0x2d0cd0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2d0cd0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0112.628] GetLastError () returned 0x0 [0112.628] SetErrorMode (uMode=0x1) returned 0x8001 [0112.629] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x22ec9c | out: lpFileInformation=0x22ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb6bee9, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cb6bee9, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xaa818efc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xb5)) returned 1 [0112.629] GetLastError () returned 0x0 [0112.629] SetErrorMode (uMode=0x8001) returned 0x1 [0114.437] VirtualProtect (in: lpAddress=0xa00178, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x23a) returned 0 [0114.453] VirtualProtect (in: lpAddress=0xa001a0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.453] VirtualProtect (in: lpAddress=0xa001c8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.458] VirtualProtect (in: lpAddress=0xaa7d2e, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.478] VirtualProtect (in: lpAddress=0xaa7d22, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.931] VirtualProtect (in: lpAddress=0xa00208, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.934] VirtualProtect (in: lpAddress=0xa58678, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa5869c, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586a4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586a8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586b0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586b4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586b8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586bc, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586c4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586c8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586cc, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586d4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586d8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586dc, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586e4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586e8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586ec, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586f0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586f8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa586fc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa58700, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa58708, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.935] VirtualProtect (in: lpAddress=0xa5870c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x22e1d8 | out: lpflOldProtect=0x22e1d8*=0x82a592eb) returned 0 [0114.941] GetEnvironmentVariableW (in: lpName="COR_PROFILER", lpBuffer=0x2d0cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.942] GetLastError () returned 0xcb [0114.945] GetEnvironmentVariableW (in: lpName="COR_ENABLE_PROFILING", lpBuffer=0x2d0cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.945] GetLastError () returned 0xcb [0115.677] SetProcessDPIAware () returned 1 [0115.677] GetLastError () returned 0x0 [0115.814] GetCurrentProcess () returned 0xffffffff [0115.814] GetCurrentThread () returned 0xfffffffe [0115.814] GetCurrentProcess () returned 0xffffffff [0115.815] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x22e820, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x22e820*=0x1b0) returned 1 [0115.815] GetLastError () returned 0x3 [0115.817] GetCurrentThreadId () returned 0xaf4 [0122.356] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="a403e9b3-6f76-41ac-ab55-e693040d1b8b") returned 0x1b4 [0122.356] GetLastError () returned 0xb7 [0122.356] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x22e7cc*=0x1b4, lpdwindex=0x22e584 | out: lpdwindex=0x22e584) returned 0x80010115 [0122.920] CloseHandle (hObject=0x1b4) returned 1 [0122.920] GetLastError () returned 0x0 [0122.928] CoGetContextToken (in: pToken=0x22e674 | out: pToken=0x22e674) returned 0x0 [0122.929] CObjectContext::QueryInterface () returned 0x0 [0122.929] CObjectContext::GetCurrentThreadType () returned 0x0 [0122.929] Release () returned 0x0 [0122.929] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x2a5ed8*=0x78, lpdwindex=0x22e4e0 | out: lpdwindex=0x22e4e0) returned 0x0 Thread: id = 255 os_tid = 0xb08 Thread: id = 256 os_tid = 0xb10 [0111.510] CoGetContextToken (in: pToken=0x3d8f348 | out: pToken=0x3d8f348) returned 0x800401f0 [0111.510] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0122.943] CloseHandle (hObject=0x1b0) returned 1 [0122.943] GetLastError () returned 0x0 Thread: id = 257 os_tid = 0xad0 [0114.949] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 258 os_tid = 0xa4c [0115.105] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 260 os_tid = 0x458 Thread: id = 261 os_tid = 0x42c Thread: id = 262 os_tid = 0xb8c Thread: id = 263 os_tid = 0x424 Thread: id = 264 os_tid = 0xba4 Process: id = "20" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x7f1f62c0" os_pid = "0x7a4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x15c" cmd_line = "\"C:\\Windows\\System32\\schtasks.exe\" /create /tn RtkAudioService64 /tr \"C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe\" /sc minute /mo 1 /F" cur_dir = "C:\\Windows\\system32\\" os_username = "ARRARNMKU\\JPenUM" os_groups = "ARRARNMKU\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ee73" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3041 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3042 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3043 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3044 start_va = 0x70000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3045 start_va = 0x350000 end_va = 0x37dfff entry_point = 0x350000 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3046 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3047 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3048 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 3049 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 3050 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 3051 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3052 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3053 start_va = 0xe0000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3054 start_va = 0x1e0000 end_va = 0x246fff entry_point = 0x1e0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3055 start_va = 0x2f0000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 3056 start_va = 0x740d0000 end_va = 0x740d8fff entry_point = 0x740d0000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 3057 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3058 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3059 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3060 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3061 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3062 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3063 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3064 start_va = 0x771d0000 end_va = 0x77226fff entry_point = 0x771d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3065 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3066 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3067 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3068 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 3069 start_va = 0x380000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 3070 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3071 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3072 start_va = 0x50000 end_va = 0x56fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3073 start_va = 0x60000 end_va = 0x61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3074 start_va = 0xb0000 end_va = 0xc1fff entry_point = 0xb0000 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3075 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3076 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3077 start_va = 0x450000 end_va = 0x550fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 3078 start_va = 0x560000 end_va = 0x115ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 3079 start_va = 0x74f80000 end_va = 0x74f88fff entry_point = 0x74f80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3085 start_va = 0x1160000 end_va = 0x142efff entry_point = 0x1160000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3086 start_va = 0x260000 end_va = 0x2bbfff entry_point = 0x260000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3087 start_va = 0x260000 end_va = 0x2bbfff entry_point = 0x260000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3088 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3089 start_va = 0x74060000 end_va = 0x7409ffff entry_point = 0x74060000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3090 start_va = 0x260000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3091 start_va = 0x1430000 end_va = 0x150efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001430000" filename = "" Region: id = 3092 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3093 start_va = 0x260000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3094 start_va = 0x2b0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 3095 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3096 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 3097 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 3098 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3099 start_va = 0x300000 end_va = 0x300fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000300000" filename = "" Region: id = 3100 start_va = 0x74640000 end_va = 0x746bcfff entry_point = 0x74640000 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3101 start_va = 0x75960000 end_va = 0x7597afff entry_point = 0x75960000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3102 start_va = 0x740a0000 end_va = 0x740cefff entry_point = 0x740a0000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 269 os_tid = 0x7a8 [0123.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xafba0 | out: lpSystemTimeAsFileTime=0xafba0*(dwLowDateTime=0x36716bb0, dwHighDateTime=0x1d4b1a5)) [0123.226] GetCurrentProcessId () returned 0x7a4 [0123.226] GetCurrentThreadId () returned 0x7a8 [0123.226] GetTickCount () returned 0xa76bdf [0123.226] RtlQueryPerformanceCounter () returned 0x1 [0123.227] GetModuleHandleA (lpModuleName=0x0) returned 0x350000 [0123.227] __set_app_type (_Type=0x1) [0123.227] __p__fmode () returned 0x76cf31f4 [0123.227] __p__commode () returned 0x76cf31fc [0123.227] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x367881) returned 0x0 [0123.228] __wgetmainargs (in: _Argc=0x379e6c, _Argv=0x379e74, _Env=0x379e70, _DoWildCard=0, _StartInfo=0x379e80 | out: _Argc=0x379e6c, _Argv=0x379e74, _Env=0x379e70) returned 0 [0123.228] _onexit (_Func=0x370fe2) returned 0x370fe2 [0123.228] _onexit (_Func=0x370ff3) returned 0x370ff3 [0123.228] _onexit (_Func=0x371002) returned 0x371002 [0123.228] _onexit (_Func=0x37101e) returned 0x37101e [0123.228] _onexit (_Func=0x37103a) returned 0x37103a [0123.228] _onexit (_Func=0x371056) returned 0x371056 [0123.228] _onexit (_Func=0x371072) returned 0x371072 [0123.228] _onexit (_Func=0x37108e) returned 0x37108e [0123.229] _onexit (_Func=0x3710aa) returned 0x3710aa [0123.229] _onexit (_Func=0x3710c6) returned 0x3710c6 [0123.229] _onexit (_Func=0x3710e2) returned 0x3710e2 [0123.229] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0123.229] WinSqmIsOptedIn () returned 0x0 [0123.229] SetLastError (dwErrCode=0x0) [0123.229] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0123.229] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0123.229] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0123.229] VerifyVersionInfoW (in: lpVersionInformation=0xaf618, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0xaf618) returned 1 [0123.229] lstrlenW (lpString="") returned 0 [0123.230] SetThreadUILanguage (LangId=0x0) returned 0x409 [0123.230] SetLastError (dwErrCode=0x0) [0123.230] _memicmp (_Buf1=0xee388, _Buf2=0x351ed8, _Size=0x7) returned 0 [0123.230] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf2ac0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0123.230] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x74f80000 [0123.232] GetProcAddress (hModule=0x74f80000, lpProcName="GetFileVersionInfoSizeW") returned 0x74f819d9 [0123.232] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\System32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0123.232] GetProcAddress (hModule=0x74f80000, lpProcName="GetFileVersionInfoW") returned 0x74f819f4 [0126.310] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\System32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0xf2ff0 | out: lpData=0xf2ff0) returned 1 [0126.310] GetProcAddress (hModule=0x74f80000, lpProcName="VerQueryValueW") returned 0x74f81b51 [0126.310] VerQueryValueW (in: pBlock=0xf2ff0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xaf720, puLen=0xaf724 | out: lplpBuffer=0xaf720*=0xf338c, puLen=0xaf724) returned 1 [0126.311] _memicmp (_Buf1=0xee388, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.311] _vsnwprintf (in: _Buffer=0xf2ac0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xaf708 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0126.311] VerQueryValueW (in: pBlock=0xf2ff0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xaf730, puLen=0xaf72c | out: lplpBuffer=0xaf730*=0xf31b8, puLen=0xaf72c) returned 1 [0126.311] lstrlenW (lpString="schtasks.exe") returned 12 [0126.311] lstrlenW (lpString="schtasks.exe") returned 12 [0126.311] lstrlenW (lpString=".EXE") returned 4 [0126.311] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0126.312] lstrlenW (lpString="schtasks.exe") returned 12 [0126.312] lstrlenW (lpString=".EXE") returned 4 [0126.312] _memicmp (_Buf1=0xee388, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.312] lstrlenW (lpString="schtasks") returned 8 [0126.312] _memicmp (_Buf1=0xee3e8, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.312] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.312] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0126.312] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0126.312] _vsnwprintf (in: _Buffer=0xf3748, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xaf70c | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0126.313] SetLastError (dwErrCode=0x0) [0126.313] GetThreadLocale () returned 0x409 [0126.313] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.313] lstrlenW (lpString="?") returned 1 [0126.313] GetThreadLocale () returned 0x409 [0126.313] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.313] lstrlenW (lpString="create") returned 6 [0126.313] GetThreadLocale () returned 0x409 [0126.313] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.313] lstrlenW (lpString="delete") returned 6 [0126.313] GetThreadLocale () returned 0x409 [0126.313] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.313] lstrlenW (lpString="query") returned 5 [0126.313] GetThreadLocale () returned 0x409 [0126.313] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.313] lstrlenW (lpString="change") returned 6 [0126.313] GetThreadLocale () returned 0x409 [0126.313] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.313] lstrlenW (lpString="run") returned 3 [0126.313] GetThreadLocale () returned 0x409 [0126.313] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.313] lstrlenW (lpString="end") returned 3 [0126.313] GetThreadLocale () returned 0x409 [0126.313] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.313] lstrlenW (lpString="showsid") returned 7 [0126.313] GetThreadLocale () returned 0x409 [0126.313] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.313] SetLastError (dwErrCode=0x0) [0126.313] SetLastError (dwErrCode=0x0) [0126.313] lstrlenW (lpString="/create") returned 7 [0126.313] lstrlenW (lpString="-/") returned 2 [0126.313] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.313] lstrlenW (lpString="?") returned 1 [0126.313] lstrlenW (lpString="?") returned 1 [0126.313] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.313] lstrlenW (lpString="create") returned 6 [0126.314] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.314] _vsnwprintf (in: _Buffer=0xee430, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|?|") returned 3 [0126.314] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|create|") returned 8 [0126.314] lstrlenW (lpString="|?|") returned 3 [0126.314] lstrlenW (lpString="|create|") returned 8 [0126.314] SetLastError (dwErrCode=0x490) [0126.314] lstrlenW (lpString="create") returned 6 [0126.314] lstrlenW (lpString="create") returned 6 [0126.314] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.314] lstrlenW (lpString="create") returned 6 [0126.314] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.314] _vsnwprintf (in: _Buffer=0xf2378, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|create|") returned 8 [0126.314] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|create|") returned 8 [0126.314] lstrlenW (lpString="|create|") returned 8 [0126.314] lstrlenW (lpString="|create|") returned 8 [0126.314] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0126.314] SetLastError (dwErrCode=0x0) [0126.314] SetLastError (dwErrCode=0x0) [0126.314] SetLastError (dwErrCode=0x0) [0126.314] lstrlenW (lpString="/tn") returned 3 [0126.314] lstrlenW (lpString="-/") returned 2 [0126.314] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.314] lstrlenW (lpString="?") returned 1 [0126.314] lstrlenW (lpString="?") returned 1 [0126.314] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.314] lstrlenW (lpString="tn") returned 2 [0126.314] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.314] _vsnwprintf (in: _Buffer=0xf2378, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|?|") returned 3 [0126.314] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tn|") returned 4 [0126.314] lstrlenW (lpString="|?|") returned 3 [0126.314] lstrlenW (lpString="|tn|") returned 4 [0126.314] SetLastError (dwErrCode=0x490) [0126.314] lstrlenW (lpString="create") returned 6 [0126.314] lstrlenW (lpString="create") returned 6 [0126.314] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.314] lstrlenW (lpString="tn") returned 2 [0126.315] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.315] _vsnwprintf (in: _Buffer=0xf2378, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|create|") returned 8 [0126.315] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tn|") returned 4 [0126.315] lstrlenW (lpString="|create|") returned 8 [0126.315] lstrlenW (lpString="|tn|") returned 4 [0126.315] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0126.315] SetLastError (dwErrCode=0x490) [0126.315] lstrlenW (lpString="delete") returned 6 [0126.315] lstrlenW (lpString="delete") returned 6 [0126.315] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.315] lstrlenW (lpString="tn") returned 2 [0126.315] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.315] _vsnwprintf (in: _Buffer=0xf2378, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|delete|") returned 8 [0126.315] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tn|") returned 4 [0126.315] lstrlenW (lpString="|delete|") returned 8 [0126.315] lstrlenW (lpString="|tn|") returned 4 [0126.315] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0126.315] SetLastError (dwErrCode=0x490) [0126.315] lstrlenW (lpString="query") returned 5 [0126.315] lstrlenW (lpString="query") returned 5 [0126.315] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.315] lstrlenW (lpString="tn") returned 2 [0126.315] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.315] _vsnwprintf (in: _Buffer=0xf2378, _BufferCount=0x8, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|query|") returned 7 [0126.315] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tn|") returned 4 [0126.315] lstrlenW (lpString="|query|") returned 7 [0126.315] lstrlenW (lpString="|tn|") returned 4 [0126.315] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0126.315] SetLastError (dwErrCode=0x490) [0126.315] lstrlenW (lpString="change") returned 6 [0126.315] lstrlenW (lpString="change") returned 6 [0126.315] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.315] lstrlenW (lpString="tn") returned 2 [0126.315] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.315] _vsnwprintf (in: _Buffer=0xf2378, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|change|") returned 8 [0126.315] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tn|") returned 4 [0126.315] lstrlenW (lpString="|change|") returned 8 [0126.315] lstrlenW (lpString="|tn|") returned 4 [0126.315] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0126.315] SetLastError (dwErrCode=0x490) [0126.316] lstrlenW (lpString="run") returned 3 [0126.316] lstrlenW (lpString="run") returned 3 [0126.316] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.316] lstrlenW (lpString="tn") returned 2 [0126.316] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.316] _vsnwprintf (in: _Buffer=0xf2378, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|run|") returned 5 [0126.316] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tn|") returned 4 [0126.316] lstrlenW (lpString="|run|") returned 5 [0126.316] lstrlenW (lpString="|tn|") returned 4 [0126.316] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0126.316] SetLastError (dwErrCode=0x490) [0126.316] lstrlenW (lpString="end") returned 3 [0126.316] lstrlenW (lpString="end") returned 3 [0126.316] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.316] lstrlenW (lpString="tn") returned 2 [0126.316] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.316] _vsnwprintf (in: _Buffer=0xf2378, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|end|") returned 5 [0126.316] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tn|") returned 4 [0126.316] lstrlenW (lpString="|end|") returned 5 [0126.316] lstrlenW (lpString="|tn|") returned 4 [0126.316] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0126.316] SetLastError (dwErrCode=0x490) [0126.316] lstrlenW (lpString="showsid") returned 7 [0126.316] lstrlenW (lpString="showsid") returned 7 [0126.316] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.316] lstrlenW (lpString="tn") returned 2 [0126.316] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.316] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0xa, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|showsid|") returned 9 [0126.316] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tn|") returned 4 [0126.316] lstrlenW (lpString="|showsid|") returned 9 [0126.316] lstrlenW (lpString="|tn|") returned 4 [0126.316] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0126.316] SetLastError (dwErrCode=0x490) [0126.316] SetLastError (dwErrCode=0x490) [0126.316] SetLastError (dwErrCode=0x0) [0126.316] lstrlenW (lpString="/tn") returned 3 [0126.316] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0126.316] SetLastError (dwErrCode=0x490) [0126.316] SetLastError (dwErrCode=0x0) [0126.316] lstrlenW (lpString="/tn") returned 3 [0126.317] SetLastError (dwErrCode=0x0) [0126.317] SetLastError (dwErrCode=0x0) [0126.317] lstrlenW (lpString="RtkAudioService64") returned 17 [0126.317] lstrlenW (lpString="-/") returned 2 [0126.317] StrChrIW (lpStart="-/", wMatch=0x52) returned 0x0 [0126.317] SetLastError (dwErrCode=0x490) [0126.317] SetLastError (dwErrCode=0x490) [0126.317] SetLastError (dwErrCode=0x0) [0126.317] lstrlenW (lpString="RtkAudioService64") returned 17 [0126.317] StrChrIW (lpStart="RtkAudioService64", wMatch=0x3a) returned 0x0 [0126.317] SetLastError (dwErrCode=0x490) [0126.317] SetLastError (dwErrCode=0x0) [0126.317] lstrlenW (lpString="RtkAudioService64") returned 17 [0126.317] SetLastError (dwErrCode=0x0) [0126.317] SetLastError (dwErrCode=0x0) [0126.317] lstrlenW (lpString="/tr") returned 3 [0126.317] lstrlenW (lpString="-/") returned 2 [0126.317] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.317] lstrlenW (lpString="?") returned 1 [0126.317] lstrlenW (lpString="?") returned 1 [0126.317] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.317] lstrlenW (lpString="tr") returned 2 [0126.317] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.317] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|?|") returned 3 [0126.317] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tr|") returned 4 [0126.317] lstrlenW (lpString="|?|") returned 3 [0126.317] lstrlenW (lpString="|tr|") returned 4 [0126.317] SetLastError (dwErrCode=0x490) [0126.317] lstrlenW (lpString="create") returned 6 [0126.317] lstrlenW (lpString="create") returned 6 [0126.317] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.317] lstrlenW (lpString="tr") returned 2 [0126.317] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.317] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|create|") returned 8 [0126.317] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tr|") returned 4 [0126.317] lstrlenW (lpString="|create|") returned 8 [0126.317] lstrlenW (lpString="|tr|") returned 4 [0126.317] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0126.317] SetLastError (dwErrCode=0x490) [0126.317] lstrlenW (lpString="delete") returned 6 [0126.318] lstrlenW (lpString="delete") returned 6 [0126.318] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.318] lstrlenW (lpString="tr") returned 2 [0126.318] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.318] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|delete|") returned 8 [0126.318] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tr|") returned 4 [0126.318] lstrlenW (lpString="|delete|") returned 8 [0126.318] lstrlenW (lpString="|tr|") returned 4 [0126.318] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0126.318] SetLastError (dwErrCode=0x490) [0126.318] lstrlenW (lpString="query") returned 5 [0126.318] lstrlenW (lpString="query") returned 5 [0126.318] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.318] lstrlenW (lpString="tr") returned 2 [0126.318] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.318] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x8, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|query|") returned 7 [0126.318] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tr|") returned 4 [0126.318] lstrlenW (lpString="|query|") returned 7 [0126.318] lstrlenW (lpString="|tr|") returned 4 [0126.318] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0126.318] SetLastError (dwErrCode=0x490) [0126.318] lstrlenW (lpString="change") returned 6 [0126.318] lstrlenW (lpString="change") returned 6 [0126.318] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.318] lstrlenW (lpString="tr") returned 2 [0126.318] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.318] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|change|") returned 8 [0126.318] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tr|") returned 4 [0126.318] lstrlenW (lpString="|change|") returned 8 [0126.318] lstrlenW (lpString="|tr|") returned 4 [0126.318] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0126.318] SetLastError (dwErrCode=0x490) [0126.318] lstrlenW (lpString="run") returned 3 [0126.318] lstrlenW (lpString="run") returned 3 [0126.318] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.318] lstrlenW (lpString="tr") returned 2 [0126.318] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.318] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|run|") returned 5 [0126.318] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tr|") returned 4 [0126.318] lstrlenW (lpString="|run|") returned 5 [0126.318] lstrlenW (lpString="|tr|") returned 4 [0126.319] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0126.319] SetLastError (dwErrCode=0x490) [0126.319] lstrlenW (lpString="end") returned 3 [0126.319] lstrlenW (lpString="end") returned 3 [0126.319] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.319] lstrlenW (lpString="tr") returned 2 [0126.319] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.319] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|end|") returned 5 [0126.319] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tr|") returned 4 [0126.319] lstrlenW (lpString="|end|") returned 5 [0126.319] lstrlenW (lpString="|tr|") returned 4 [0126.319] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0126.319] SetLastError (dwErrCode=0x490) [0126.319] lstrlenW (lpString="showsid") returned 7 [0126.319] lstrlenW (lpString="showsid") returned 7 [0126.319] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.319] lstrlenW (lpString="tr") returned 2 [0126.319] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.319] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0xa, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|showsid|") returned 9 [0126.319] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|tr|") returned 4 [0126.319] lstrlenW (lpString="|showsid|") returned 9 [0126.319] lstrlenW (lpString="|tr|") returned 4 [0126.319] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0126.319] SetLastError (dwErrCode=0x490) [0126.319] SetLastError (dwErrCode=0x490) [0126.319] SetLastError (dwErrCode=0x0) [0126.319] lstrlenW (lpString="/tr") returned 3 [0126.319] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0126.319] SetLastError (dwErrCode=0x490) [0126.319] SetLastError (dwErrCode=0x0) [0126.319] lstrlenW (lpString="/tr") returned 3 [0126.319] SetLastError (dwErrCode=0x0) [0126.319] SetLastError (dwErrCode=0x0) [0126.319] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.319] lstrlenW (lpString="-/") returned 2 [0126.319] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0126.319] SetLastError (dwErrCode=0x490) [0126.319] SetLastError (dwErrCode=0x490) [0126.319] SetLastError (dwErrCode=0x0) [0126.319] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.319] StrChrIW (lpStart="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", wMatch=0x3a) returned=":\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" [0126.319] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.320] _memicmp (_Buf1=0xee430, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.320] _memicmp (_Buf1=0xee478, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.320] SetLastError (dwErrCode=0x7a) [0126.320] SetLastError (dwErrCode=0x0) [0126.320] SetLastError (dwErrCode=0x0) [0126.320] lstrlenW (lpString="C") returned 1 [0126.320] SetLastError (dwErrCode=0x490) [0126.320] SetLastError (dwErrCode=0x0) [0126.320] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.320] SetLastError (dwErrCode=0x0) [0126.320] SetLastError (dwErrCode=0x0) [0126.320] lstrlenW (lpString="/sc") returned 3 [0126.320] lstrlenW (lpString="-/") returned 2 [0126.320] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.320] lstrlenW (lpString="?") returned 1 [0126.320] lstrlenW (lpString="?") returned 1 [0126.320] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.320] lstrlenW (lpString="sc") returned 2 [0126.320] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.320] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|?|") returned 3 [0126.320] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|sc|") returned 4 [0126.320] lstrlenW (lpString="|?|") returned 3 [0126.320] lstrlenW (lpString="|sc|") returned 4 [0126.320] SetLastError (dwErrCode=0x490) [0126.320] lstrlenW (lpString="create") returned 6 [0126.320] lstrlenW (lpString="create") returned 6 [0126.320] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.320] lstrlenW (lpString="sc") returned 2 [0126.320] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.320] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|create|") returned 8 [0126.320] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|sc|") returned 4 [0126.320] lstrlenW (lpString="|create|") returned 8 [0126.320] lstrlenW (lpString="|sc|") returned 4 [0126.320] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0126.320] SetLastError (dwErrCode=0x490) [0126.320] lstrlenW (lpString="delete") returned 6 [0126.320] lstrlenW (lpString="delete") returned 6 [0126.321] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.321] lstrlenW (lpString="sc") returned 2 [0126.321] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.321] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|delete|") returned 8 [0126.321] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|sc|") returned 4 [0126.321] lstrlenW (lpString="|delete|") returned 8 [0126.321] lstrlenW (lpString="|sc|") returned 4 [0126.321] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0126.321] SetLastError (dwErrCode=0x490) [0126.321] lstrlenW (lpString="query") returned 5 [0126.321] lstrlenW (lpString="query") returned 5 [0126.321] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.321] lstrlenW (lpString="sc") returned 2 [0126.321] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.321] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x8, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|query|") returned 7 [0126.321] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|sc|") returned 4 [0126.321] lstrlenW (lpString="|query|") returned 7 [0126.321] lstrlenW (lpString="|sc|") returned 4 [0126.321] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0126.321] SetLastError (dwErrCode=0x490) [0126.321] lstrlenW (lpString="change") returned 6 [0126.321] lstrlenW (lpString="change") returned 6 [0126.321] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.321] lstrlenW (lpString="sc") returned 2 [0126.321] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.321] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|change|") returned 8 [0126.321] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|sc|") returned 4 [0126.321] lstrlenW (lpString="|change|") returned 8 [0126.321] lstrlenW (lpString="|sc|") returned 4 [0126.321] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0126.321] SetLastError (dwErrCode=0x490) [0126.321] lstrlenW (lpString="run") returned 3 [0126.321] lstrlenW (lpString="run") returned 3 [0126.321] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.322] lstrlenW (lpString="sc") returned 2 [0126.322] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.322] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|run|") returned 5 [0126.322] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|sc|") returned 4 [0126.322] lstrlenW (lpString="|run|") returned 5 [0126.322] lstrlenW (lpString="|sc|") returned 4 [0126.322] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0126.322] SetLastError (dwErrCode=0x490) [0126.322] lstrlenW (lpString="end") returned 3 [0126.322] lstrlenW (lpString="end") returned 3 [0126.322] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.322] lstrlenW (lpString="sc") returned 2 [0126.322] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.322] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|end|") returned 5 [0126.322] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|sc|") returned 4 [0126.322] lstrlenW (lpString="|end|") returned 5 [0126.322] lstrlenW (lpString="|sc|") returned 4 [0126.322] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0126.322] SetLastError (dwErrCode=0x490) [0126.322] lstrlenW (lpString="showsid") returned 7 [0126.322] lstrlenW (lpString="showsid") returned 7 [0126.322] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.322] lstrlenW (lpString="sc") returned 2 [0126.322] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.322] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0xa, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|showsid|") returned 9 [0126.322] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|sc|") returned 4 [0126.322] lstrlenW (lpString="|showsid|") returned 9 [0126.322] lstrlenW (lpString="|sc|") returned 4 [0126.322] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0126.322] SetLastError (dwErrCode=0x490) [0126.322] SetLastError (dwErrCode=0x490) [0126.322] SetLastError (dwErrCode=0x0) [0126.322] lstrlenW (lpString="/sc") returned 3 [0126.322] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0126.322] SetLastError (dwErrCode=0x490) [0126.322] SetLastError (dwErrCode=0x0) [0126.322] lstrlenW (lpString="/sc") returned 3 [0126.322] SetLastError (dwErrCode=0x0) [0126.322] SetLastError (dwErrCode=0x0) [0126.322] lstrlenW (lpString="minute") returned 6 [0126.323] lstrlenW (lpString="-/") returned 2 [0126.323] StrChrIW (lpStart="-/", wMatch=0x6d) returned 0x0 [0126.323] SetLastError (dwErrCode=0x490) [0126.323] SetLastError (dwErrCode=0x490) [0126.323] SetLastError (dwErrCode=0x0) [0126.323] lstrlenW (lpString="minute") returned 6 [0126.323] StrChrIW (lpStart="minute", wMatch=0x3a) returned 0x0 [0126.323] SetLastError (dwErrCode=0x490) [0126.323] SetLastError (dwErrCode=0x0) [0126.323] lstrlenW (lpString="minute") returned 6 [0126.323] SetLastError (dwErrCode=0x0) [0126.323] SetLastError (dwErrCode=0x0) [0126.323] lstrlenW (lpString="/mo") returned 3 [0126.323] lstrlenW (lpString="-/") returned 2 [0126.323] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.323] lstrlenW (lpString="?") returned 1 [0126.323] lstrlenW (lpString="?") returned 1 [0126.323] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.323] lstrlenW (lpString="mo") returned 2 [0126.323] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.323] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|?|") returned 3 [0126.323] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|mo|") returned 4 [0126.323] lstrlenW (lpString="|?|") returned 3 [0126.323] lstrlenW (lpString="|mo|") returned 4 [0126.323] SetLastError (dwErrCode=0x490) [0126.323] lstrlenW (lpString="create") returned 6 [0126.323] lstrlenW (lpString="create") returned 6 [0126.323] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.323] lstrlenW (lpString="mo") returned 2 [0126.323] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.323] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|create|") returned 8 [0126.323] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|mo|") returned 4 [0126.323] lstrlenW (lpString="|create|") returned 8 [0126.323] lstrlenW (lpString="|mo|") returned 4 [0126.323] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0126.323] SetLastError (dwErrCode=0x490) [0126.323] lstrlenW (lpString="delete") returned 6 [0126.323] lstrlenW (lpString="delete") returned 6 [0126.323] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.323] lstrlenW (lpString="mo") returned 2 [0126.323] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.324] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|delete|") returned 8 [0126.324] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|mo|") returned 4 [0126.324] lstrlenW (lpString="|delete|") returned 8 [0126.324] lstrlenW (lpString="|mo|") returned 4 [0126.324] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0126.324] SetLastError (dwErrCode=0x490) [0126.324] lstrlenW (lpString="query") returned 5 [0126.324] lstrlenW (lpString="query") returned 5 [0126.324] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.324] lstrlenW (lpString="mo") returned 2 [0126.324] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.324] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x8, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|query|") returned 7 [0126.324] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|mo|") returned 4 [0126.324] lstrlenW (lpString="|query|") returned 7 [0126.324] lstrlenW (lpString="|mo|") returned 4 [0126.324] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0126.324] SetLastError (dwErrCode=0x490) [0126.324] lstrlenW (lpString="change") returned 6 [0126.324] lstrlenW (lpString="change") returned 6 [0126.324] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.324] lstrlenW (lpString="mo") returned 2 [0126.324] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.324] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|change|") returned 8 [0126.324] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|mo|") returned 4 [0126.324] lstrlenW (lpString="|change|") returned 8 [0126.324] lstrlenW (lpString="|mo|") returned 4 [0126.324] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0126.324] SetLastError (dwErrCode=0x490) [0126.324] lstrlenW (lpString="run") returned 3 [0126.324] lstrlenW (lpString="run") returned 3 [0126.324] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.324] lstrlenW (lpString="mo") returned 2 [0126.324] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.324] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|run|") returned 5 [0126.324] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|mo|") returned 4 [0126.324] lstrlenW (lpString="|run|") returned 5 [0126.324] lstrlenW (lpString="|mo|") returned 4 [0126.324] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0126.324] SetLastError (dwErrCode=0x490) [0126.324] lstrlenW (lpString="end") returned 3 [0126.324] lstrlenW (lpString="end") returned 3 [0126.324] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.325] lstrlenW (lpString="mo") returned 2 [0126.325] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.325] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|end|") returned 5 [0126.325] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|mo|") returned 4 [0126.325] lstrlenW (lpString="|end|") returned 5 [0126.325] lstrlenW (lpString="|mo|") returned 4 [0126.325] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0126.325] SetLastError (dwErrCode=0x490) [0126.325] lstrlenW (lpString="showsid") returned 7 [0126.325] lstrlenW (lpString="showsid") returned 7 [0126.325] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.325] lstrlenW (lpString="mo") returned 2 [0126.325] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.325] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0xa, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|showsid|") returned 9 [0126.325] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|mo|") returned 4 [0126.325] lstrlenW (lpString="|showsid|") returned 9 [0126.325] lstrlenW (lpString="|mo|") returned 4 [0126.325] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0126.325] SetLastError (dwErrCode=0x490) [0126.325] SetLastError (dwErrCode=0x490) [0126.325] SetLastError (dwErrCode=0x0) [0126.325] lstrlenW (lpString="/mo") returned 3 [0126.325] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0126.325] SetLastError (dwErrCode=0x490) [0126.325] SetLastError (dwErrCode=0x0) [0126.325] lstrlenW (lpString="/mo") returned 3 [0126.325] SetLastError (dwErrCode=0x0) [0126.325] SetLastError (dwErrCode=0x0) [0126.325] lstrlenW (lpString="1") returned 1 [0126.325] SetLastError (dwErrCode=0x490) [0126.325] SetLastError (dwErrCode=0x0) [0126.325] lstrlenW (lpString="1") returned 1 [0126.325] StrChrIW (lpStart="1", wMatch=0x3a) returned 0x0 [0126.325] SetLastError (dwErrCode=0x490) [0126.325] SetLastError (dwErrCode=0x0) [0126.325] lstrlenW (lpString="1") returned 1 [0126.325] SetLastError (dwErrCode=0x0) [0126.325] SetLastError (dwErrCode=0x0) [0126.325] lstrlenW (lpString="/F") returned 2 [0126.325] lstrlenW (lpString="-/") returned 2 [0126.325] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.326] lstrlenW (lpString="?") returned 1 [0126.326] lstrlenW (lpString="?") returned 1 [0126.326] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.326] lstrlenW (lpString="F") returned 1 [0126.326] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.326] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|?|") returned 3 [0126.326] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|F|") returned 3 [0126.326] lstrlenW (lpString="|?|") returned 3 [0126.326] lstrlenW (lpString="|F|") returned 3 [0126.326] StrStrIW (lpFirst="|?|", lpSrch="|F|") returned 0x0 [0126.326] SetLastError (dwErrCode=0x490) [0126.326] lstrlenW (lpString="create") returned 6 [0126.326] lstrlenW (lpString="create") returned 6 [0126.326] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.326] lstrlenW (lpString="F") returned 1 [0126.326] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.326] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|create|") returned 8 [0126.326] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|F|") returned 3 [0126.326] lstrlenW (lpString="|create|") returned 8 [0126.326] lstrlenW (lpString="|F|") returned 3 [0126.326] StrStrIW (lpFirst="|create|", lpSrch="|F|") returned 0x0 [0126.326] SetLastError (dwErrCode=0x490) [0126.326] lstrlenW (lpString="delete") returned 6 [0126.326] lstrlenW (lpString="delete") returned 6 [0126.326] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.326] lstrlenW (lpString="F") returned 1 [0126.326] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.326] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|delete|") returned 8 [0126.326] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|F|") returned 3 [0126.326] lstrlenW (lpString="|delete|") returned 8 [0126.326] lstrlenW (lpString="|F|") returned 3 [0126.326] StrStrIW (lpFirst="|delete|", lpSrch="|F|") returned 0x0 [0126.326] SetLastError (dwErrCode=0x490) [0126.326] lstrlenW (lpString="query") returned 5 [0126.326] lstrlenW (lpString="query") returned 5 [0126.326] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.326] lstrlenW (lpString="F") returned 1 [0126.326] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.326] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x8, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|query|") returned 7 [0126.326] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|F|") returned 3 [0126.326] lstrlenW (lpString="|query|") returned 7 [0126.326] lstrlenW (lpString="|F|") returned 3 [0126.327] StrStrIW (lpFirst="|query|", lpSrch="|F|") returned 0x0 [0126.327] SetLastError (dwErrCode=0x490) [0126.327] lstrlenW (lpString="change") returned 6 [0126.327] lstrlenW (lpString="change") returned 6 [0126.327] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.327] lstrlenW (lpString="F") returned 1 [0126.327] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.327] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|change|") returned 8 [0126.327] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|F|") returned 3 [0126.327] lstrlenW (lpString="|change|") returned 8 [0126.327] lstrlenW (lpString="|F|") returned 3 [0126.327] StrStrIW (lpFirst="|change|", lpSrch="|F|") returned 0x0 [0126.327] SetLastError (dwErrCode=0x490) [0126.327] lstrlenW (lpString="run") returned 3 [0126.327] lstrlenW (lpString="run") returned 3 [0126.327] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.327] lstrlenW (lpString="F") returned 1 [0126.327] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.327] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|run|") returned 5 [0126.327] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|F|") returned 3 [0126.327] lstrlenW (lpString="|run|") returned 5 [0126.327] lstrlenW (lpString="|F|") returned 3 [0126.327] StrStrIW (lpFirst="|run|", lpSrch="|F|") returned 0x0 [0126.327] SetLastError (dwErrCode=0x490) [0126.327] lstrlenW (lpString="end") returned 3 [0126.327] lstrlenW (lpString="end") returned 3 [0126.327] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.327] lstrlenW (lpString="F") returned 1 [0126.327] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.327] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|end|") returned 5 [0126.327] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|F|") returned 3 [0126.327] lstrlenW (lpString="|end|") returned 5 [0126.327] lstrlenW (lpString="|F|") returned 3 [0126.327] StrStrIW (lpFirst="|end|", lpSrch="|F|") returned 0x0 [0126.327] SetLastError (dwErrCode=0x490) [0126.327] lstrlenW (lpString="showsid") returned 7 [0126.327] lstrlenW (lpString="showsid") returned 7 [0126.327] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.327] lstrlenW (lpString="F") returned 1 [0126.327] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.327] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0xa, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|showsid|") returned 9 [0126.327] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaf6f4 | out: _Buffer="|F|") returned 3 [0126.328] lstrlenW (lpString="|showsid|") returned 9 [0126.328] lstrlenW (lpString="|F|") returned 3 [0126.328] StrStrIW (lpFirst="|showsid|", lpSrch="|F|") returned 0x0 [0126.328] SetLastError (dwErrCode=0x490) [0126.328] SetLastError (dwErrCode=0x490) [0126.328] SetLastError (dwErrCode=0x0) [0126.328] lstrlenW (lpString="/F") returned 2 [0126.328] StrChrIW (lpStart="/F", wMatch=0x3a) returned 0x0 [0126.328] SetLastError (dwErrCode=0x490) [0126.328] SetLastError (dwErrCode=0x0) [0126.328] lstrlenW (lpString="/F") returned 2 [0126.328] SetLastError (dwErrCode=0x0) [0126.330] SetLastError (dwErrCode=0x0) [0126.330] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0126.330] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0126.330] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0126.330] VerifyVersionInfoW (in: lpVersionInformation=0xacb0c, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0xacb0c) returned 1 [0126.330] SetLastError (dwErrCode=0x0) [0126.330] lstrlenW (lpString="create") returned 6 [0126.330] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0126.330] SetLastError (dwErrCode=0x490) [0126.330] SetLastError (dwErrCode=0x0) [0126.330] lstrlenW (lpString="create") returned 6 [0126.330] _memicmp (_Buf1=0xee310, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.330] SetLastError (dwErrCode=0x0) [0126.330] _memicmp (_Buf1=0xee388, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.330] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf2ac0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0126.330] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\System32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0126.331] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\System32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0xf2ff0 | out: lpData=0xf2ff0) returned 1 [0126.331] VerQueryValueW (in: pBlock=0xf2ff0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xacc14, puLen=0xacc18 | out: lplpBuffer=0xacc14*=0xf338c, puLen=0xacc18) returned 1 [0126.331] _memicmp (_Buf1=0xee388, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.331] _vsnwprintf (in: _Buffer=0xf2ac0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xacbfc | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0126.331] VerQueryValueW (in: pBlock=0xf2ff0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xacc24, puLen=0xacc20 | out: lplpBuffer=0xacc24*=0xf31b8, puLen=0xacc20) returned 1 [0126.331] lstrlenW (lpString="schtasks.exe") returned 12 [0126.331] lstrlenW (lpString="schtasks.exe") returned 12 [0126.331] lstrlenW (lpString=".EXE") returned 4 [0126.331] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0126.331] lstrlenW (lpString="schtasks.exe") returned 12 [0126.331] lstrlenW (lpString=".EXE") returned 4 [0126.331] lstrlenW (lpString="schtasks") returned 8 [0126.331] lstrlenW (lpString="/create") returned 7 [0126.331] _memicmp (_Buf1=0xee388, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.331] _vsnwprintf (in: _Buffer=0xf2ac0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xacbfc | out: _Buffer="schtasks /create") returned 16 [0126.331] _memicmp (_Buf1=0xee3e8, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.331] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.331] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0126.331] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0126.331] _vsnwprintf (in: _Buffer=0xf3748, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xacc00 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0126.331] SetLastError (dwErrCode=0x0) [0126.331] GetThreadLocale () returned 0x409 [0126.331] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.331] lstrlenW (lpString="create") returned 6 [0126.331] GetThreadLocale () returned 0x409 [0126.331] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.331] lstrlenW (lpString="?") returned 1 [0126.331] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="s") returned 1 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="u") returned 1 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="p") returned 1 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="ru") returned 2 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="rp") returned 2 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="sc") returned 2 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="mo") returned 2 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="d") returned 1 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="m") returned 1 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="i") returned 1 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="tn") returned 2 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="tr") returned 2 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="st") returned 2 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="sd") returned 2 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="ed") returned 2 [0126.332] GetThreadLocale () returned 0x409 [0126.332] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.332] lstrlenW (lpString="it") returned 2 [0126.332] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="et") returned 2 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="k") returned 1 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="du") returned 2 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="ri") returned 2 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="z") returned 1 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="f") returned 1 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="v1") returned 2 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="xml") returned 3 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="ec") returned 2 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="rl") returned 2 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="delay") returned 5 [0126.333] GetThreadLocale () returned 0x409 [0126.333] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.333] lstrlenW (lpString="np") returned 2 [0126.333] SetLastError (dwErrCode=0x0) [0126.333] SetLastError (dwErrCode=0x0) [0126.333] lstrlenW (lpString="/create") returned 7 [0126.333] lstrlenW (lpString="-/") returned 2 [0126.333] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.333] lstrlenW (lpString="create") returned 6 [0126.333] lstrlenW (lpString="create") returned 6 [0126.333] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.333] lstrlenW (lpString="create") returned 6 [0126.333] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.333] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|create|") returned 8 [0126.334] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x9, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|create|") returned 8 [0126.334] lstrlenW (lpString="|create|") returned 8 [0126.334] lstrlenW (lpString="|create|") returned 8 [0126.334] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0126.334] SetLastError (dwErrCode=0x0) [0126.334] SetLastError (dwErrCode=0x0) [0126.334] SetLastError (dwErrCode=0x0) [0126.334] lstrlenW (lpString="/tn") returned 3 [0126.334] lstrlenW (lpString="-/") returned 2 [0126.334] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.334] lstrlenW (lpString="create") returned 6 [0126.334] lstrlenW (lpString="create") returned 6 [0126.334] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.334] lstrlenW (lpString="tn") returned 2 [0126.334] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.334] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|create|") returned 8 [0126.334] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.334] lstrlenW (lpString="|create|") returned 8 [0126.334] lstrlenW (lpString="|tn|") returned 4 [0126.334] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0126.334] SetLastError (dwErrCode=0x490) [0126.334] lstrlenW (lpString="?") returned 1 [0126.334] lstrlenW (lpString="?") returned 1 [0126.334] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.334] lstrlenW (lpString="tn") returned 2 [0126.334] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.334] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|?|") returned 3 [0126.334] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.334] lstrlenW (lpString="|?|") returned 3 [0126.334] lstrlenW (lpString="|tn|") returned 4 [0126.334] SetLastError (dwErrCode=0x490) [0126.334] lstrlenW (lpString="s") returned 1 [0126.334] lstrlenW (lpString="s") returned 1 [0126.334] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.334] lstrlenW (lpString="tn") returned 2 [0126.334] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.334] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|s|") returned 3 [0126.334] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.334] lstrlenW (lpString="|s|") returned 3 [0126.334] lstrlenW (lpString="|tn|") returned 4 [0126.334] SetLastError (dwErrCode=0x490) [0126.334] lstrlenW (lpString="u") returned 1 [0126.334] lstrlenW (lpString="u") returned 1 [0126.335] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.335] lstrlenW (lpString="tn") returned 2 [0126.335] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.335] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|u|") returned 3 [0126.335] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.335] lstrlenW (lpString="|u|") returned 3 [0126.335] lstrlenW (lpString="|tn|") returned 4 [0126.335] SetLastError (dwErrCode=0x490) [0126.335] lstrlenW (lpString="p") returned 1 [0126.335] lstrlenW (lpString="p") returned 1 [0126.335] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.335] lstrlenW (lpString="tn") returned 2 [0126.335] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.335] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|p|") returned 3 [0126.335] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.335] lstrlenW (lpString="|p|") returned 3 [0126.335] lstrlenW (lpString="|tn|") returned 4 [0126.335] SetLastError (dwErrCode=0x490) [0126.335] lstrlenW (lpString="ru") returned 2 [0126.335] lstrlenW (lpString="ru") returned 2 [0126.335] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.335] lstrlenW (lpString="tn") returned 2 [0126.335] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.335] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|ru|") returned 4 [0126.335] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.335] lstrlenW (lpString="|ru|") returned 4 [0126.335] lstrlenW (lpString="|tn|") returned 4 [0126.335] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0126.335] SetLastError (dwErrCode=0x490) [0126.335] lstrlenW (lpString="rp") returned 2 [0126.335] lstrlenW (lpString="rp") returned 2 [0126.335] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.335] lstrlenW (lpString="tn") returned 2 [0126.335] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.335] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|rp|") returned 4 [0126.335] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.335] lstrlenW (lpString="|rp|") returned 4 [0126.335] lstrlenW (lpString="|tn|") returned 4 [0126.335] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0126.335] SetLastError (dwErrCode=0x490) [0126.336] lstrlenW (lpString="sc") returned 2 [0126.336] lstrlenW (lpString="sc") returned 2 [0126.336] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.336] lstrlenW (lpString="tn") returned 2 [0126.336] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.336] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.336] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.336] lstrlenW (lpString="|sc|") returned 4 [0126.336] lstrlenW (lpString="|tn|") returned 4 [0126.336] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0126.336] SetLastError (dwErrCode=0x490) [0126.336] lstrlenW (lpString="mo") returned 2 [0126.336] lstrlenW (lpString="mo") returned 2 [0126.336] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.336] lstrlenW (lpString="tn") returned 2 [0126.336] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.336] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.336] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.336] lstrlenW (lpString="|mo|") returned 4 [0126.336] lstrlenW (lpString="|tn|") returned 4 [0126.336] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0126.336] SetLastError (dwErrCode=0x490) [0126.336] lstrlenW (lpString="d") returned 1 [0126.336] lstrlenW (lpString="d") returned 1 [0126.336] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.336] lstrlenW (lpString="tn") returned 2 [0126.336] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.336] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|d|") returned 3 [0126.336] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.336] lstrlenW (lpString="|d|") returned 3 [0126.336] lstrlenW (lpString="|tn|") returned 4 [0126.336] SetLastError (dwErrCode=0x490) [0126.336] lstrlenW (lpString="m") returned 1 [0126.336] lstrlenW (lpString="m") returned 1 [0126.336] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.336] lstrlenW (lpString="tn") returned 2 [0126.336] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.336] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|m|") returned 3 [0126.336] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.336] lstrlenW (lpString="|m|") returned 3 [0126.336] lstrlenW (lpString="|tn|") returned 4 [0126.337] SetLastError (dwErrCode=0x490) [0126.337] lstrlenW (lpString="i") returned 1 [0126.337] lstrlenW (lpString="i") returned 1 [0126.337] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.337] lstrlenW (lpString="tn") returned 2 [0126.337] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.337] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|i|") returned 3 [0126.337] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.337] lstrlenW (lpString="|i|") returned 3 [0126.337] lstrlenW (lpString="|tn|") returned 4 [0126.337] SetLastError (dwErrCode=0x490) [0126.337] lstrlenW (lpString="tn") returned 2 [0126.337] lstrlenW (lpString="tn") returned 2 [0126.337] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.337] lstrlenW (lpString="tn") returned 2 [0126.337] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.337] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.337] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.337] lstrlenW (lpString="|tn|") returned 4 [0126.337] lstrlenW (lpString="|tn|") returned 4 [0126.337] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0126.337] SetLastError (dwErrCode=0x0) [0126.337] SetLastError (dwErrCode=0x0) [0126.337] lstrlenW (lpString="RtkAudioService64") returned 17 [0126.337] lstrlenW (lpString="-/") returned 2 [0126.337] StrChrIW (lpStart="-/", wMatch=0x52) returned 0x0 [0126.337] SetLastError (dwErrCode=0x490) [0126.337] SetLastError (dwErrCode=0x490) [0126.337] SetLastError (dwErrCode=0x0) [0126.337] lstrlenW (lpString="RtkAudioService64") returned 17 [0126.337] StrChrIW (lpStart="RtkAudioService64", wMatch=0x3a) returned 0x0 [0126.337] SetLastError (dwErrCode=0x490) [0126.337] SetLastError (dwErrCode=0x0) [0126.337] lstrlenW (lpString="RtkAudioService64") returned 17 [0126.337] SetLastError (dwErrCode=0x0) [0126.337] SetLastError (dwErrCode=0x0) [0126.337] lstrlenW (lpString="/tr") returned 3 [0126.337] lstrlenW (lpString="-/") returned 2 [0126.337] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.337] lstrlenW (lpString="create") returned 6 [0126.337] lstrlenW (lpString="create") returned 6 [0126.337] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.337] lstrlenW (lpString="tr") returned 2 [0126.337] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.338] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|create|") returned 8 [0126.338] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.338] lstrlenW (lpString="|create|") returned 8 [0126.338] lstrlenW (lpString="|tr|") returned 4 [0126.338] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0126.338] SetLastError (dwErrCode=0x490) [0126.338] lstrlenW (lpString="?") returned 1 [0126.338] lstrlenW (lpString="?") returned 1 [0126.338] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.338] lstrlenW (lpString="tr") returned 2 [0126.338] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.338] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|?|") returned 3 [0126.338] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.338] lstrlenW (lpString="|?|") returned 3 [0126.338] lstrlenW (lpString="|tr|") returned 4 [0126.338] SetLastError (dwErrCode=0x490) [0126.338] lstrlenW (lpString="s") returned 1 [0126.338] lstrlenW (lpString="s") returned 1 [0126.338] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.338] lstrlenW (lpString="tr") returned 2 [0126.338] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.338] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|s|") returned 3 [0126.338] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.338] lstrlenW (lpString="|s|") returned 3 [0126.338] lstrlenW (lpString="|tr|") returned 4 [0126.338] SetLastError (dwErrCode=0x490) [0126.338] lstrlenW (lpString="u") returned 1 [0126.338] lstrlenW (lpString="u") returned 1 [0126.338] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.338] lstrlenW (lpString="tr") returned 2 [0126.338] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.338] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|u|") returned 3 [0126.338] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.338] lstrlenW (lpString="|u|") returned 3 [0126.338] lstrlenW (lpString="|tr|") returned 4 [0126.338] SetLastError (dwErrCode=0x490) [0126.338] lstrlenW (lpString="p") returned 1 [0126.338] lstrlenW (lpString="p") returned 1 [0126.338] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.338] lstrlenW (lpString="tr") returned 2 [0126.338] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.338] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|p|") returned 3 [0126.339] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.339] lstrlenW (lpString="|p|") returned 3 [0126.339] lstrlenW (lpString="|tr|") returned 4 [0126.339] SetLastError (dwErrCode=0x490) [0126.339] lstrlenW (lpString="ru") returned 2 [0126.339] lstrlenW (lpString="ru") returned 2 [0126.339] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.339] lstrlenW (lpString="tr") returned 2 [0126.339] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.339] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|ru|") returned 4 [0126.339] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.339] lstrlenW (lpString="|ru|") returned 4 [0126.339] lstrlenW (lpString="|tr|") returned 4 [0126.339] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0126.339] SetLastError (dwErrCode=0x490) [0126.339] lstrlenW (lpString="rp") returned 2 [0126.339] lstrlenW (lpString="rp") returned 2 [0126.339] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.339] lstrlenW (lpString="tr") returned 2 [0126.339] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.339] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|rp|") returned 4 [0126.339] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.339] lstrlenW (lpString="|rp|") returned 4 [0126.339] lstrlenW (lpString="|tr|") returned 4 [0126.339] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0126.339] SetLastError (dwErrCode=0x490) [0126.339] lstrlenW (lpString="sc") returned 2 [0126.339] lstrlenW (lpString="sc") returned 2 [0126.339] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.339] lstrlenW (lpString="tr") returned 2 [0126.339] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.339] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.339] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.339] lstrlenW (lpString="|sc|") returned 4 [0126.339] lstrlenW (lpString="|tr|") returned 4 [0126.339] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0126.339] SetLastError (dwErrCode=0x490) [0126.339] lstrlenW (lpString="mo") returned 2 [0126.339] lstrlenW (lpString="mo") returned 2 [0126.339] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.339] lstrlenW (lpString="tr") returned 2 [0126.340] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.340] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.340] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.340] lstrlenW (lpString="|mo|") returned 4 [0126.340] lstrlenW (lpString="|tr|") returned 4 [0126.340] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0126.340] SetLastError (dwErrCode=0x490) [0126.340] lstrlenW (lpString="d") returned 1 [0126.340] lstrlenW (lpString="d") returned 1 [0126.340] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.340] lstrlenW (lpString="tr") returned 2 [0126.340] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.340] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|d|") returned 3 [0126.340] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.340] lstrlenW (lpString="|d|") returned 3 [0126.340] lstrlenW (lpString="|tr|") returned 4 [0126.340] SetLastError (dwErrCode=0x490) [0126.340] lstrlenW (lpString="m") returned 1 [0126.340] lstrlenW (lpString="m") returned 1 [0126.340] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.340] lstrlenW (lpString="tr") returned 2 [0126.340] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.340] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|m|") returned 3 [0126.340] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.340] lstrlenW (lpString="|m|") returned 3 [0126.340] lstrlenW (lpString="|tr|") returned 4 [0126.340] SetLastError (dwErrCode=0x490) [0126.340] lstrlenW (lpString="i") returned 1 [0126.340] lstrlenW (lpString="i") returned 1 [0126.340] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.340] lstrlenW (lpString="tr") returned 2 [0126.340] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.340] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|i|") returned 3 [0126.340] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.340] lstrlenW (lpString="|i|") returned 3 [0126.340] lstrlenW (lpString="|tr|") returned 4 [0126.340] SetLastError (dwErrCode=0x490) [0126.340] lstrlenW (lpString="tn") returned 2 [0126.340] lstrlenW (lpString="tn") returned 2 [0126.340] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.340] lstrlenW (lpString="tr") returned 2 [0126.340] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.341] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.341] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.341] lstrlenW (lpString="|tn|") returned 4 [0126.341] lstrlenW (lpString="|tr|") returned 4 [0126.341] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0126.341] SetLastError (dwErrCode=0x490) [0126.341] lstrlenW (lpString="tr") returned 2 [0126.341] lstrlenW (lpString="tr") returned 2 [0126.341] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.341] lstrlenW (lpString="tr") returned 2 [0126.341] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.341] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.341] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.341] lstrlenW (lpString="|tr|") returned 4 [0126.341] lstrlenW (lpString="|tr|") returned 4 [0126.341] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0126.341] SetLastError (dwErrCode=0x0) [0126.341] SetLastError (dwErrCode=0x0) [0126.341] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.341] lstrlenW (lpString="-/") returned 2 [0126.341] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0126.341] SetLastError (dwErrCode=0x490) [0126.341] SetLastError (dwErrCode=0x490) [0126.341] SetLastError (dwErrCode=0x0) [0126.341] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.341] StrChrIW (lpStart="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe", wMatch=0x3a) returned=":\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe" [0126.341] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.341] _memicmp (_Buf1=0xee430, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.341] _memicmp (_Buf1=0xee478, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.341] SetLastError (dwErrCode=0x7a) [0126.341] SetLastError (dwErrCode=0x0) [0126.341] SetLastError (dwErrCode=0x0) [0126.341] lstrlenW (lpString="C") returned 1 [0126.341] SetLastError (dwErrCode=0x490) [0126.341] SetLastError (dwErrCode=0x0) [0126.341] _memicmp (_Buf1=0xee490, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.341] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.341] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.341] lstrlenW (lpString=" \x09") returned 2 [0126.341] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0126.341] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0126.341] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x4a) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0126.342] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0126.343] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0126.343] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0126.343] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0126.343] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0126.343] GetLastError () returned 0x0 [0126.343] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.343] lstrlenW (lpString="C:\\Users\\JPenUM\\AppData\\Roaming\\appmgr\\RtlUpd64.exe") returned 51 [0126.343] SetLastError (dwErrCode=0x0) [0126.343] SetLastError (dwErrCode=0x0) [0126.343] lstrlenW (lpString="/sc") returned 3 [0126.343] lstrlenW (lpString="-/") returned 2 [0126.343] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.343] lstrlenW (lpString="create") returned 6 [0126.343] lstrlenW (lpString="create") returned 6 [0126.343] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.343] lstrlenW (lpString="sc") returned 2 [0126.343] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.343] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|create|") returned 8 [0126.343] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.343] lstrlenW (lpString="|create|") returned 8 [0126.343] lstrlenW (lpString="|sc|") returned 4 [0126.343] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0126.343] SetLastError (dwErrCode=0x490) [0126.343] lstrlenW (lpString="?") returned 1 [0126.343] lstrlenW (lpString="?") returned 1 [0126.343] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.343] lstrlenW (lpString="sc") returned 2 [0126.343] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.343] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|?|") returned 3 [0126.343] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.343] lstrlenW (lpString="|?|") returned 3 [0126.343] lstrlenW (lpString="|sc|") returned 4 [0126.343] SetLastError (dwErrCode=0x490) [0126.343] lstrlenW (lpString="s") returned 1 [0126.343] lstrlenW (lpString="s") returned 1 [0126.343] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.343] lstrlenW (lpString="sc") returned 2 [0126.343] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.343] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|s|") returned 3 [0126.343] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.343] lstrlenW (lpString="|s|") returned 3 [0126.343] lstrlenW (lpString="|sc|") returned 4 [0126.344] SetLastError (dwErrCode=0x490) [0126.344] lstrlenW (lpString="u") returned 1 [0126.344] lstrlenW (lpString="u") returned 1 [0126.344] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.344] lstrlenW (lpString="sc") returned 2 [0126.344] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.344] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|u|") returned 3 [0126.344] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.344] lstrlenW (lpString="|u|") returned 3 [0126.344] lstrlenW (lpString="|sc|") returned 4 [0126.344] SetLastError (dwErrCode=0x490) [0126.344] lstrlenW (lpString="p") returned 1 [0126.344] lstrlenW (lpString="p") returned 1 [0126.344] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.344] lstrlenW (lpString="sc") returned 2 [0126.344] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.344] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|p|") returned 3 [0126.344] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.344] lstrlenW (lpString="|p|") returned 3 [0126.344] lstrlenW (lpString="|sc|") returned 4 [0126.344] SetLastError (dwErrCode=0x490) [0126.344] lstrlenW (lpString="ru") returned 2 [0126.344] lstrlenW (lpString="ru") returned 2 [0126.344] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.344] lstrlenW (lpString="sc") returned 2 [0126.344] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.344] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|ru|") returned 4 [0126.344] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.344] lstrlenW (lpString="|ru|") returned 4 [0126.344] lstrlenW (lpString="|sc|") returned 4 [0126.344] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0126.344] SetLastError (dwErrCode=0x490) [0126.344] lstrlenW (lpString="rp") returned 2 [0126.344] lstrlenW (lpString="rp") returned 2 [0126.344] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.344] lstrlenW (lpString="sc") returned 2 [0126.344] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.344] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|rp|") returned 4 [0126.344] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.344] lstrlenW (lpString="|rp|") returned 4 [0126.344] lstrlenW (lpString="|sc|") returned 4 [0126.344] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0126.345] SetLastError (dwErrCode=0x490) [0126.345] lstrlenW (lpString="sc") returned 2 [0126.345] lstrlenW (lpString="sc") returned 2 [0126.345] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.345] lstrlenW (lpString="sc") returned 2 [0126.345] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.345] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.345] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.345] lstrlenW (lpString="|sc|") returned 4 [0126.345] lstrlenW (lpString="|sc|") returned 4 [0126.345] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0126.345] SetLastError (dwErrCode=0x0) [0126.345] SetLastError (dwErrCode=0x0) [0126.345] lstrlenW (lpString="minute") returned 6 [0126.345] lstrlenW (lpString="-/") returned 2 [0126.345] StrChrIW (lpStart="-/", wMatch=0x6d) returned 0x0 [0126.345] SetLastError (dwErrCode=0x490) [0126.345] SetLastError (dwErrCode=0x490) [0126.345] SetLastError (dwErrCode=0x0) [0126.345] lstrlenW (lpString="minute") returned 6 [0126.345] StrChrIW (lpStart="minute", wMatch=0x3a) returned 0x0 [0126.345] SetLastError (dwErrCode=0x490) [0126.345] SetLastError (dwErrCode=0x0) [0126.345] _memicmp (_Buf1=0xee490, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.345] lstrlenW (lpString="minute") returned 6 [0126.345] lstrlenW (lpString="minute") returned 6 [0126.345] lstrlenW (lpString=" \x09") returned 2 [0126.345] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0126.345] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0126.345] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0126.345] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0126.345] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0126.345] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0126.345] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0126.345] GetLastError () returned 0x0 [0126.345] lstrlenW (lpString="minute") returned 6 [0126.345] lstrlenW (lpString="minute") returned 6 [0126.345] SetLastError (dwErrCode=0x0) [0126.345] SetLastError (dwErrCode=0x0) [0126.345] lstrlenW (lpString="/mo") returned 3 [0126.345] lstrlenW (lpString="-/") returned 2 [0126.345] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.345] lstrlenW (lpString="create") returned 6 [0126.345] lstrlenW (lpString="create") returned 6 [0126.345] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.345] lstrlenW (lpString="mo") returned 2 [0126.346] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.346] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|create|") returned 8 [0126.346] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.346] lstrlenW (lpString="|create|") returned 8 [0126.346] lstrlenW (lpString="|mo|") returned 4 [0126.346] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0126.346] SetLastError (dwErrCode=0x490) [0126.346] lstrlenW (lpString="?") returned 1 [0126.346] lstrlenW (lpString="?") returned 1 [0126.346] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.346] lstrlenW (lpString="mo") returned 2 [0126.346] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.346] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|?|") returned 3 [0126.346] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.346] lstrlenW (lpString="|?|") returned 3 [0126.346] lstrlenW (lpString="|mo|") returned 4 [0126.346] SetLastError (dwErrCode=0x490) [0126.346] lstrlenW (lpString="s") returned 1 [0126.346] lstrlenW (lpString="s") returned 1 [0126.346] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.346] lstrlenW (lpString="mo") returned 2 [0126.346] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.346] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|s|") returned 3 [0126.346] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.346] lstrlenW (lpString="|s|") returned 3 [0126.346] lstrlenW (lpString="|mo|") returned 4 [0126.346] SetLastError (dwErrCode=0x490) [0126.346] lstrlenW (lpString="u") returned 1 [0126.346] lstrlenW (lpString="u") returned 1 [0126.346] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.346] lstrlenW (lpString="mo") returned 2 [0126.346] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.346] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|u|") returned 3 [0126.346] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.346] lstrlenW (lpString="|u|") returned 3 [0126.346] lstrlenW (lpString="|mo|") returned 4 [0126.346] SetLastError (dwErrCode=0x490) [0126.346] lstrlenW (lpString="p") returned 1 [0126.346] lstrlenW (lpString="p") returned 1 [0126.346] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.346] lstrlenW (lpString="mo") returned 2 [0126.347] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.347] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|p|") returned 3 [0126.347] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.347] lstrlenW (lpString="|p|") returned 3 [0126.347] lstrlenW (lpString="|mo|") returned 4 [0126.347] SetLastError (dwErrCode=0x490) [0126.347] lstrlenW (lpString="ru") returned 2 [0126.347] lstrlenW (lpString="ru") returned 2 [0126.347] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.347] lstrlenW (lpString="mo") returned 2 [0126.347] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.347] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|ru|") returned 4 [0126.347] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.347] lstrlenW (lpString="|ru|") returned 4 [0126.347] lstrlenW (lpString="|mo|") returned 4 [0126.347] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0126.347] SetLastError (dwErrCode=0x490) [0126.347] lstrlenW (lpString="rp") returned 2 [0126.347] lstrlenW (lpString="rp") returned 2 [0126.347] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.347] lstrlenW (lpString="mo") returned 2 [0126.347] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.347] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|rp|") returned 4 [0126.347] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.347] lstrlenW (lpString="|rp|") returned 4 [0126.347] lstrlenW (lpString="|mo|") returned 4 [0126.347] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0126.347] SetLastError (dwErrCode=0x490) [0126.347] lstrlenW (lpString="sc") returned 2 [0126.347] lstrlenW (lpString="sc") returned 2 [0126.347] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.347] lstrlenW (lpString="mo") returned 2 [0126.347] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.347] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.347] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.347] lstrlenW (lpString="|sc|") returned 4 [0126.347] lstrlenW (lpString="|mo|") returned 4 [0126.347] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0126.347] SetLastError (dwErrCode=0x490) [0126.347] lstrlenW (lpString="mo") returned 2 [0126.347] lstrlenW (lpString="mo") returned 2 [0126.347] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.348] lstrlenW (lpString="mo") returned 2 [0126.348] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.348] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.348] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.348] lstrlenW (lpString="|mo|") returned 4 [0126.348] lstrlenW (lpString="|mo|") returned 4 [0126.348] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0126.348] SetLastError (dwErrCode=0x0) [0126.348] SetLastError (dwErrCode=0x0) [0126.348] lstrlenW (lpString="1") returned 1 [0126.348] SetLastError (dwErrCode=0x490) [0126.348] SetLastError (dwErrCode=0x0) [0126.348] lstrlenW (lpString="1") returned 1 [0126.348] StrChrIW (lpStart="1", wMatch=0x3a) returned 0x0 [0126.348] SetLastError (dwErrCode=0x490) [0126.348] SetLastError (dwErrCode=0x0) [0126.348] _memicmp (_Buf1=0xee490, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.348] lstrlenW (lpString="1") returned 1 [0126.348] lstrlenW (lpString="1") returned 1 [0126.348] lstrlenW (lpString=" \x09") returned 2 [0126.348] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0126.348] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0126.348] GetLastError () returned 0x0 [0126.348] lstrlenW (lpString="1") returned 1 [0126.348] lstrlenW (lpString="1") returned 1 [0126.348] SetLastError (dwErrCode=0x0) [0126.348] SetLastError (dwErrCode=0x0) [0126.348] lstrlenW (lpString="/F") returned 2 [0126.348] lstrlenW (lpString="-/") returned 2 [0126.348] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.348] lstrlenW (lpString="create") returned 6 [0126.348] lstrlenW (lpString="create") returned 6 [0126.348] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.348] lstrlenW (lpString="F") returned 1 [0126.348] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.348] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x9, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|create|") returned 8 [0126.348] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.348] lstrlenW (lpString="|create|") returned 8 [0126.348] lstrlenW (lpString="|F|") returned 3 [0126.348] StrStrIW (lpFirst="|create|", lpSrch="|F|") returned 0x0 [0126.348] SetLastError (dwErrCode=0x490) [0126.348] lstrlenW (lpString="?") returned 1 [0126.348] lstrlenW (lpString="?") returned 1 [0126.348] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.349] lstrlenW (lpString="F") returned 1 [0126.349] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.349] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|?|") returned 3 [0126.349] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.349] lstrlenW (lpString="|?|") returned 3 [0126.349] lstrlenW (lpString="|F|") returned 3 [0126.349] StrStrIW (lpFirst="|?|", lpSrch="|F|") returned 0x0 [0126.349] SetLastError (dwErrCode=0x490) [0126.349] lstrlenW (lpString="s") returned 1 [0126.349] lstrlenW (lpString="s") returned 1 [0126.349] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.349] lstrlenW (lpString="F") returned 1 [0126.349] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.349] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|s|") returned 3 [0126.349] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.349] lstrlenW (lpString="|s|") returned 3 [0126.349] lstrlenW (lpString="|F|") returned 3 [0126.349] StrStrIW (lpFirst="|s|", lpSrch="|F|") returned 0x0 [0126.349] SetLastError (dwErrCode=0x490) [0126.349] lstrlenW (lpString="u") returned 1 [0126.349] lstrlenW (lpString="u") returned 1 [0126.349] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.349] lstrlenW (lpString="F") returned 1 [0126.349] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.349] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|u|") returned 3 [0126.349] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.349] lstrlenW (lpString="|u|") returned 3 [0126.349] lstrlenW (lpString="|F|") returned 3 [0126.349] StrStrIW (lpFirst="|u|", lpSrch="|F|") returned 0x0 [0126.349] SetLastError (dwErrCode=0x490) [0126.349] lstrlenW (lpString="p") returned 1 [0126.349] lstrlenW (lpString="p") returned 1 [0126.349] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.349] lstrlenW (lpString="F") returned 1 [0126.349] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.349] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|p|") returned 3 [0126.349] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.349] lstrlenW (lpString="|p|") returned 3 [0126.349] lstrlenW (lpString="|F|") returned 3 [0126.349] StrStrIW (lpFirst="|p|", lpSrch="|F|") returned 0x0 [0126.349] SetLastError (dwErrCode=0x490) [0126.350] lstrlenW (lpString="ru") returned 2 [0126.350] lstrlenW (lpString="ru") returned 2 [0126.350] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.350] lstrlenW (lpString="F") returned 1 [0126.350] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.350] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|ru|") returned 4 [0126.350] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.350] lstrlenW (lpString="|ru|") returned 4 [0126.350] lstrlenW (lpString="|F|") returned 3 [0126.350] StrStrIW (lpFirst="|ru|", lpSrch="|F|") returned 0x0 [0126.350] SetLastError (dwErrCode=0x490) [0126.350] lstrlenW (lpString="rp") returned 2 [0126.350] lstrlenW (lpString="rp") returned 2 [0126.350] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.350] lstrlenW (lpString="F") returned 1 [0126.350] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.350] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|rp|") returned 4 [0126.350] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.350] lstrlenW (lpString="|rp|") returned 4 [0126.350] lstrlenW (lpString="|F|") returned 3 [0126.350] StrStrIW (lpFirst="|rp|", lpSrch="|F|") returned 0x0 [0126.350] SetLastError (dwErrCode=0x490) [0126.350] lstrlenW (lpString="sc") returned 2 [0126.350] lstrlenW (lpString="sc") returned 2 [0126.350] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.350] lstrlenW (lpString="F") returned 1 [0126.350] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.350] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sc|") returned 4 [0126.350] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.350] lstrlenW (lpString="|sc|") returned 4 [0126.350] lstrlenW (lpString="|F|") returned 3 [0126.350] StrStrIW (lpFirst="|sc|", lpSrch="|F|") returned 0x0 [0126.350] SetLastError (dwErrCode=0x490) [0126.350] lstrlenW (lpString="mo") returned 2 [0126.350] lstrlenW (lpString="mo") returned 2 [0126.350] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.350] lstrlenW (lpString="F") returned 1 [0126.350] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.350] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|mo|") returned 4 [0126.350] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.350] lstrlenW (lpString="|mo|") returned 4 [0126.350] lstrlenW (lpString="|F|") returned 3 [0126.351] StrStrIW (lpFirst="|mo|", lpSrch="|F|") returned 0x0 [0126.351] SetLastError (dwErrCode=0x490) [0126.351] lstrlenW (lpString="d") returned 1 [0126.351] lstrlenW (lpString="d") returned 1 [0126.351] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.351] lstrlenW (lpString="F") returned 1 [0126.351] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.351] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|d|") returned 3 [0126.351] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.351] lstrlenW (lpString="|d|") returned 3 [0126.351] lstrlenW (lpString="|F|") returned 3 [0126.351] StrStrIW (lpFirst="|d|", lpSrch="|F|") returned 0x0 [0126.351] SetLastError (dwErrCode=0x490) [0126.351] lstrlenW (lpString="m") returned 1 [0126.351] lstrlenW (lpString="m") returned 1 [0126.351] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.351] lstrlenW (lpString="F") returned 1 [0126.351] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.351] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|m|") returned 3 [0126.351] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.351] lstrlenW (lpString="|m|") returned 3 [0126.351] lstrlenW (lpString="|F|") returned 3 [0126.351] StrStrIW (lpFirst="|m|", lpSrch="|F|") returned 0x0 [0126.351] SetLastError (dwErrCode=0x490) [0126.351] lstrlenW (lpString="i") returned 1 [0126.351] lstrlenW (lpString="i") returned 1 [0126.351] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.351] lstrlenW (lpString="F") returned 1 [0126.351] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.351] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|i|") returned 3 [0126.351] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.351] lstrlenW (lpString="|i|") returned 3 [0126.351] lstrlenW (lpString="|F|") returned 3 [0126.351] StrStrIW (lpFirst="|i|", lpSrch="|F|") returned 0x0 [0126.351] SetLastError (dwErrCode=0x490) [0126.351] lstrlenW (lpString="tn") returned 2 [0126.351] lstrlenW (lpString="tn") returned 2 [0126.351] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.351] lstrlenW (lpString="F") returned 1 [0126.351] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.351] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tn|") returned 4 [0126.352] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.352] lstrlenW (lpString="|tn|") returned 4 [0126.352] lstrlenW (lpString="|F|") returned 3 [0126.352] StrStrIW (lpFirst="|tn|", lpSrch="|F|") returned 0x0 [0126.352] SetLastError (dwErrCode=0x490) [0126.352] lstrlenW (lpString="tr") returned 2 [0126.352] lstrlenW (lpString="tr") returned 2 [0126.352] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.352] lstrlenW (lpString="F") returned 1 [0126.352] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.352] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|tr|") returned 4 [0126.352] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.352] lstrlenW (lpString="|tr|") returned 4 [0126.401] lstrlenW (lpString="|F|") returned 3 [0126.401] StrStrIW (lpFirst="|tr|", lpSrch="|F|") returned 0x0 [0126.401] SetLastError (dwErrCode=0x490) [0126.401] lstrlenW (lpString="st") returned 2 [0126.401] lstrlenW (lpString="st") returned 2 [0126.401] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.401] lstrlenW (lpString="F") returned 1 [0126.401] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.401] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|st|") returned 4 [0126.401] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.401] lstrlenW (lpString="|st|") returned 4 [0126.401] lstrlenW (lpString="|F|") returned 3 [0126.401] StrStrIW (lpFirst="|st|", lpSrch="|F|") returned 0x0 [0126.401] SetLastError (dwErrCode=0x490) [0126.401] lstrlenW (lpString="sd") returned 2 [0126.401] lstrlenW (lpString="sd") returned 2 [0126.401] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.401] lstrlenW (lpString="F") returned 1 [0126.401] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.401] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|sd|") returned 4 [0126.401] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.401] lstrlenW (lpString="|sd|") returned 4 [0126.401] lstrlenW (lpString="|F|") returned 3 [0126.401] StrStrIW (lpFirst="|sd|", lpSrch="|F|") returned 0x0 [0126.401] SetLastError (dwErrCode=0x490) [0126.401] lstrlenW (lpString="ed") returned 2 [0126.401] lstrlenW (lpString="ed") returned 2 [0126.401] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.401] lstrlenW (lpString="F") returned 1 [0126.401] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.401] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|ed|") returned 4 [0126.401] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.401] lstrlenW (lpString="|ed|") returned 4 [0126.401] lstrlenW (lpString="|F|") returned 3 [0126.401] StrStrIW (lpFirst="|ed|", lpSrch="|F|") returned 0x0 [0126.401] SetLastError (dwErrCode=0x490) [0126.401] lstrlenW (lpString="it") returned 2 [0126.401] lstrlenW (lpString="it") returned 2 [0126.401] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.402] lstrlenW (lpString="F") returned 1 [0126.402] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.402] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|it|") returned 4 [0126.402] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.402] lstrlenW (lpString="|it|") returned 4 [0126.402] lstrlenW (lpString="|F|") returned 3 [0126.402] StrStrIW (lpFirst="|it|", lpSrch="|F|") returned 0x0 [0126.402] SetLastError (dwErrCode=0x490) [0126.402] lstrlenW (lpString="et") returned 2 [0126.402] lstrlenW (lpString="et") returned 2 [0126.402] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.402] lstrlenW (lpString="F") returned 1 [0126.402] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.402] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|et|") returned 4 [0126.402] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.402] lstrlenW (lpString="|et|") returned 4 [0126.402] lstrlenW (lpString="|F|") returned 3 [0126.402] StrStrIW (lpFirst="|et|", lpSrch="|F|") returned 0x0 [0126.402] SetLastError (dwErrCode=0x490) [0126.402] lstrlenW (lpString="k") returned 1 [0126.402] lstrlenW (lpString="k") returned 1 [0126.402] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.402] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.402] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|k|") returned 3 [0126.402] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.402] lstrlenW (lpString="|k|") returned 3 [0126.402] lstrlenW (lpString="|F|") returned 3 [0126.402] StrStrIW (lpFirst="|k|", lpSrch="|F|") returned 0x0 [0126.402] SetLastError (dwErrCode=0x490) [0126.402] lstrlenW (lpString="du") returned 2 [0126.402] lstrlenW (lpString="du") returned 2 [0126.402] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.402] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.403] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|du|") returned 4 [0126.403] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.403] lstrlenW (lpString="|du|") returned 4 [0126.403] lstrlenW (lpString="|F|") returned 3 [0126.403] StrStrIW (lpFirst="|du|", lpSrch="|F|") returned 0x0 [0126.403] SetLastError (dwErrCode=0x490) [0126.403] lstrlenW (lpString="ri") returned 2 [0126.403] lstrlenW (lpString="ri") returned 2 [0126.403] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.403] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.403] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x5, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|ri|") returned 4 [0126.403] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.403] lstrlenW (lpString="|ri|") returned 4 [0126.403] lstrlenW (lpString="|F|") returned 3 [0126.403] StrStrIW (lpFirst="|ri|", lpSrch="|F|") returned 0x0 [0126.403] SetLastError (dwErrCode=0x490) [0126.403] lstrlenW (lpString="z") returned 1 [0126.403] lstrlenW (lpString="z") returned 1 [0126.403] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.403] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.403] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|z|") returned 3 [0126.403] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.403] lstrlenW (lpString="|z|") returned 3 [0126.403] lstrlenW (lpString="|F|") returned 3 [0126.403] StrStrIW (lpFirst="|z|", lpSrch="|F|") returned 0x0 [0126.403] SetLastError (dwErrCode=0x490) [0126.403] lstrlenW (lpString="f") returned 1 [0126.403] lstrlenW (lpString="f") returned 1 [0126.403] _memicmp (_Buf1=0xee418, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.403] _memicmp (_Buf1=0xee448, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.404] _vsnwprintf (in: _Buffer=0xf2398, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|f|") returned 3 [0126.404] _vsnwprintf (in: _Buffer=0xf2358, _BufferCount=0x4, _Format="|%s|", _ArgList=0xacbe8 | out: _Buffer="|F|") returned 3 [0126.404] lstrlenW (lpString="|f|") returned 3 [0126.404] lstrlenW (lpString="|F|") returned 3 [0126.404] StrStrIW (lpFirst="|f|", lpSrch="|F|") returned="|f|" [0126.404] SetLastError (dwErrCode=0x0) [0126.404] SetLastError (dwErrCode=0x0) [0126.404] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.404] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0126.404] lstrlenW (lpString="MINUTE") returned 6 [0126.404] GetThreadLocale () returned 0x409 [0126.404] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="minute", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0126.404] SetLastError (dwErrCode=0x0) [0126.404] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.404] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0126.404] lstrlenW (lpString="First") returned 5 [0126.404] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.405] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0126.405] lstrlenW (lpString="Second") returned 6 [0126.405] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.405] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0126.405] lstrlenW (lpString="Third") returned 5 [0126.405] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.405] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0126.405] lstrlenW (lpString="Fourth") returned 6 [0126.405] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.405] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0126.405] lstrlenW (lpString="Last") returned 4 [0126.405] lstrlenW (lpString="1") returned 1 [0126.405] _wtol (_String="1") returned 1 [0126.405] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.405] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0126.406] lstrlenW (lpString="First") returned 5 [0126.406] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.406] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0126.406] lstrlenW (lpString="Second") returned 6 [0126.406] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.406] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0126.406] lstrlenW (lpString="Third") returned 5 [0126.406] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.406] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0126.406] lstrlenW (lpString="Fourth") returned 6 [0126.406] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.406] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0126.406] lstrlenW (lpString="Last") returned 4 [0126.406] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xaca8c, cchData=128 | out: lpLCData="0") returned 2 [0126.406] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.406] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0126.406] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0126.407] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xaca94, cchData=128 | out: lpLCData="0") returned 2 [0126.407] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.407] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0126.407] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0126.407] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0126.417] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0126.423] CoCreateInstance (in: rclsid=0x35230c*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x3520fc*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xad018 | out: ppv=0xad018*=0x2f25e8) returned 0x0 [0126.428] TaskScheduler:ITaskService:Connect (This=0x2f25e8, serverName=0xacf88*(varType=0x8, wReserved1=0x8711, wReserved2=0xd01c, wReserved3=0xa, varVal1=0x0, varVal2=0xad000), user=0xacf98*(varType=0x0, wReserved1=0x75c2, wReserved2=0xa4ff, wReserved3=0xa9a2, varVal1=0xaeaf4, varVal2=0xadf04), domain=0xacfa8*(varType=0x0, wReserved1=0x8149, wReserved2=0xdecc, wReserved3=0xa, varVal1=0x35994e, varVal2=0xf2f58), password=0xacfb8*(varType=0x0, wReserved1=0x7793, wReserved2=0x3c, wReserved3=0x0, varVal1=0x8711a000, varVal2=0x21)) returned 0x0 [0126.431] TaskScheduler:IUnknown:AddRef (This=0x2f25e8) returned 0x2 [0126.431] TaskScheduler:ITaskService:GetFolder (in: This=0x2f25e8, Path=0x0, ppFolder=0xad0bc | out: ppFolder=0xad0bc*=0x2f26d8) returned 0x0 [0126.434] TaskScheduler:ITaskService:NewTask (in: This=0x2f25e8, flags=0x0, ppDefinition=0xad0cc | out: ppDefinition=0xad0cc*=0x2f2728) returned 0x0 [0126.434] ITaskDefinition:get_Actions (in: This=0x2f2728, ppActions=0xad018 | out: ppActions=0xad018*=0x2f27a0) returned 0x0 [0126.434] IActionCollection:Create (in: This=0x2f27a0, Type=0, ppAction=0xad030 | out: ppAction=0xad030*=0x2f29d8) returned 0x0 [0126.435] IUnknown:Release (This=0x2f29d8) returned 0x1 [0126.435] IUnknown:Release (This=0x2f27a0) returned 0x1 [0126.435] ITaskDefinition:get_Triggers (in: This=0x2f2728, ppTriggers=0xacc04 | out: ppTriggers=0xacc04*=0x2f2858) returned 0x0 [0126.435] ITriggerCollection:Create (in: This=0x2f2858, Type=1, ppTrigger=0xacc10 | out: ppTrigger=0xacc10*=0x2f2a28) returned 0x0 [0126.435] lstrlenW (lpString="1") returned 1 [0126.435] _vsnwprintf (in: _Buffer=0xacba4, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xacb98 | out: _Buffer="PT1M") returned 4 [0126.435] ITrigger:get_Repetition (in: This=0x2f2a28, ppRepeat=0xacc14 | out: ppRepeat=0xacc14*=0x2f2a78) returned 0x0 [0126.435] IRepetitionPattern:put_Interval (This=0x2f2a78, Interval="PT1M") returned 0x0 [0126.435] IUnknown:Release (This=0x2f2a78) returned 0x1 [0126.435] _vsnwprintf (in: _Buffer=0xacb74, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xacb5c | out: _Buffer="2019-01-21T12:20:00") returned 19 [0126.435] ITrigger:put_StartBoundary (This=0x2f2a28, StartBoundary="2019-01-21T12:20:00") returned 0x0 [0126.435] lstrlenW (lpString="") returned 0 [0126.435] lstrlenW (lpString="") returned 0 [0126.435] lstrlenW (lpString="") returned 0 [0126.435] lstrlenW (lpString="") returned 0 [0126.435] IUnknown:Release (This=0x2f2a28) returned 0x1 [0126.435] IUnknown:Release (This=0x2f2858) returned 0x1 [0126.436] ITaskDefinition:get_Settings (in: This=0x2f2728, ppSettings=0xad020 | out: ppSettings=0xad020*=0x2f2898) returned 0x0 [0126.436] lstrlenW (lpString="") returned 0 [0126.436] IUnknown:Release (This=0x2f2898) returned 0x1 [0126.436] GetLocalTime (in: lpSystemTime=0xacf10 | out: lpSystemTime=0xacf10*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x1, wDay=0x15, wHour=0xc, wMinute=0x14, wSecond=0x1b, wMilliseconds=0x180)) [0126.436] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x76f70000 [0126.436] GetProcAddress (hModule=0x76f70000, lpProcName="GetUserNameW") returned 0x76f8157a [0126.436] GetUserNameW (in: lpBuffer=0xacf24, pcbBuffer=0xacf0c | out: lpBuffer="JPenUM", pcbBuffer=0xacf0c) returned 1 [0126.436] ITaskDefinition:get_RegistrationInfo (in: This=0x2f2728, ppRegistrationInfo=0xacf20 | out: ppRegistrationInfo=0xacf20*=0x2f27e8) returned 0x0 [0126.436] IRegistrationInfo:put_Author (This=0x2f27e8, Author="JPenUM") returned 0x0 [0126.436] _vsnwprintf (in: _Buffer=0xacf24, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xacee4 | out: _Buffer="2019-01-21T12:20:27") returned 19 [0126.436] IRegistrationInfo:put_Date (This=0x2f27e8, Date="2019-01-21T12:20:27") returned 0x0 [0126.436] IUnknown:Release (This=0x2f27e8) returned 0x1 [0126.437] lstrlenW (lpString="") returned 0 [0126.437] ITaskFolder:RegisterTaskDefinition (in: This=0x2f26d8, Path="RtkAudioService64", pDefinition=0x2f2728, flags=6, UserId=0xad008*(varType=0x0, wReserved1=0x0, wReserved2=0x4150, wReserved3=0x5352, varVal1=0x325245, varVal2=0x1), password=0xad018*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xad02c*(varType=0x0, wReserved1=0x0, wReserved2=0xccb4, wReserved3=0xa, varVal1=0x0, varVal2=0x0), ppTask=0xad0b8 | out: ppTask=0xad0b8*=0x2f2bc8) returned 0x0 [0126.999] _memicmp (_Buf1=0xee400, _Buf2=0x351ed8, _Size=0x7) returned 0 [0126.999] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0xf37f0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0126.999] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0127.000] GetFileType (hFile=0x7) returned 0x2 [0127.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0127.000] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xad000 | out: lpMode=0xad000) returned 1 [0127.000] __iob_func () returned 0x76cf2900 [0127.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0127.000] lstrlenW (lpString="SUCCESS: The scheduled task \"RtkAudioService64\" has successfully been created.\n") returned 79 [0127.000] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xad4d0*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0xad028, lpReserved=0x0 | out: lpBuffer=0xad4d0*, lpNumberOfCharsWritten=0xad028*=0x4f) returned 1 [0127.000] IUnknown:Release (This=0x2f2bc8) returned 0x0 [0127.000] TaskScheduler:IUnknown:Release (This=0x2f2728) returned 0x0 [0127.000] TaskScheduler:IUnknown:Release (This=0x2f26d8) returned 0x0 [0127.000] TaskScheduler:IUnknown:Release (This=0x2f25e8) returned 0x1 [0127.000] lstrlenW (lpString="") returned 0 [0127.000] lstrlenW (lpString="1") returned 1 [0127.000] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 Thread: id = 270 os_tid = 0xbd4 Process: id = "21" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x7f1f67c0" os_pid = "0x418" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x354" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Local Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00098955" [0xc000000f] Region: id = 3103 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3104 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3105 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3106 start_va = 0xa0000 end_va = 0xdffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3107 start_va = 0x8a0000 end_va = 0x8e0fff entry_point = 0x8a0000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 3108 start_va = 0x778e0000 end_va = 0x77a1bfff entry_point = 0x778e0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3109 start_va = 0x77b20000 end_va = 0x77b20fff entry_point = 0x77b20000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3110 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 3111 start_va = 0x7ffd3000 end_va = 0x7ffd3fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd3000" filename = "" Region: id = 3112 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 3113 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3114 start_va = 0xe0000 end_va = 0x146fff entry_point = 0xe0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3115 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3116 start_va = 0x75c20000 end_va = 0x75c69fff entry_point = 0x75c20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3117 start_va = 0x75e90000 end_va = 0x75ea8fff entry_point = 0x75e90000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3118 start_va = 0x76ba0000 end_va = 0x76c40fff entry_point = 0x76ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3119 start_va = 0x76c50000 end_va = 0x76cfbfff entry_point = 0x76c50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3120 start_va = 0x76f70000 end_va = 0x7700ffff entry_point = 0x76f70000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3121 start_va = 0x777b0000 end_va = 0x77883fff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3122 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 3123 start_va = 0x75d30000 end_va = 0x75df8fff entry_point = 0x75d30000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3124 start_va = 0x75ec0000 end_va = 0x75f0dfff entry_point = 0x75ec0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3125 start_va = 0x77130000 end_va = 0x771ccfff entry_point = 0x77130000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3126 start_va = 0x77a20000 end_va = 0x77a29fff entry_point = 0x77a20000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3127 start_va = 0x71f00000 end_va = 0x71f5bfff entry_point = 0x71f00000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 3128 start_va = 0x75e00000 end_va = 0x75e8efff entry_point = 0x75e00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3129 start_va = 0x76b60000 end_va = 0x76b94fff entry_point = 0x76b60000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3130 start_va = 0x772b0000 end_va = 0x7740bfff entry_point = 0x772b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3131 start_va = 0x77b00000 end_va = 0x77b05fff entry_point = 0x77b00000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3132 start_va = 0x719d0000 end_va = 0x719e7fff entry_point = 0x719d0000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 3133 start_va = 0x719f0000 end_va = 0x71a85fff entry_point = 0x719f0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3134 start_va = 0x712f0000 end_va = 0x712fefff entry_point = 0x712f0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 3135 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 3136 start_va = 0x320000 end_va = 0x3e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 3137 start_va = 0x76ea0000 end_va = 0x76f6bfff entry_point = 0x76ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3138 start_va = 0x77010000 end_va = 0x7702efff entry_point = 0x77010000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3139 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3140 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3141 start_va = 0x60000 end_va = 0x66fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3142 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3143 start_va = 0x270000 end_va = 0x2effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 3144 start_va = 0x3f0000 end_va = 0x4f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 3145 start_va = 0x500000 end_va = 0x57ffff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 3146 start_va = 0x600000 end_va = 0x63ffff entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 3147 start_va = 0x7d0000 end_va = 0x80ffff entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 3148 start_va = 0x8f0000 end_va = 0xbbefff entry_point = 0x8f0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3149 start_va = 0xbc0000 end_va = 0xfb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 3150 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3151 start_va = 0x748a0000 end_va = 0x748c0fff entry_point = 0x748a0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3152 start_va = 0x77890000 end_va = 0x778d4fff entry_point = 0x77890000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3153 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 3154 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3155 start_va = 0x640000 end_va = 0x73ffff entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 3156 start_va = 0x770000 end_va = 0x7affff entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 3157 start_va = 0x850000 end_va = 0x88ffff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 3158 start_va = 0x77a70000 end_va = 0x77af2fff entry_point = 0x77a70000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3159 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 3160 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 3161 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 3162 start_va = 0x719c0000 end_va = 0x719c9fff entry_point = 0x719c0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3163 start_va = 0x1110000 end_va = 0x114ffff entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 3164 start_va = 0x752a0000 end_va = 0x752dafff entry_point = 0x752a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3165 start_va = 0x75500000 end_va = 0x75515fff entry_point = 0x75500000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3166 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 3167 start_va = 0x75a20000 end_va = 0x75a2dfff entry_point = 0x75a20000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3168 start_va = 0xfc0000 end_va = 0xffffff entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 3169 start_va = 0x1070000 end_va = 0x10affff entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 3170 start_va = 0x715a0000 end_va = 0x715aefff entry_point = 0x715a0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3171 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 3172 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 3173 start_va = 0x1000000 end_va = 0x103ffff entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 3174 start_va = 0x71490000 end_va = 0x714a6fff entry_point = 0x71490000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 3175 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 3176 start_va = 0x6ec40000 end_va = 0x6ec4efff entry_point = 0x6ec40000 region_type = mapped_file name = "wmiperfinst.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfInst.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfinst.dll") Region: id = 3177 start_va = 0x6fca0000 end_va = 0x6fcdbfff entry_point = 0x6fca0000 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 3178 start_va = 0x5c0000 end_va = 0x5fffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 3179 start_va = 0x1150000 end_va = 0x124ffff entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 3180 start_va = 0x1250000 end_va = 0x14dafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001250000" filename = "" Region: id = 3181 start_va = 0x14e0000 end_va = 0x15d8fff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 3182 start_va = 0x15e0000 end_va = 0x16dffff entry_point = 0x0 region_type = private name = "private_0x00000000015e0000" filename = "" Region: id = 3183 start_va = 0x17b0000 end_va = 0x17bffff entry_point = 0x0 region_type = private name = "private_0x00000000017b0000" filename = "" Region: id = 3184 start_va = 0x6ccd0000 end_va = 0x6ccd8fff entry_point = 0x6ccd0000 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Thread: id = 272 os_tid = 0xbc8 Thread: id = 273 os_tid = 0xbe0 Thread: id = 274 os_tid = 0xbf4 Thread: id = 275 os_tid = 0xbf8 Thread: id = 276 os_tid = 0xbfc Thread: id = 277 os_tid = 0xc0c Thread: id = 278 os_tid = 0xc1c